[00:00.000 --> 00:04.000] Two years ago, I was sitting in the Paris hotel, [00:04.720 --> 00:08.020] the Thursday morning that DEFCON was to start, [00:08.020 --> 00:12.140] and my phone rang. And I was a little nervous to answer it [00:12.140 --> 00:15.460] because I kind of knew what the phone call was about. [00:15.940 --> 00:19.280] And it was my doctor calling me back [00:19.980 --> 00:23.680] to tell me that the biopsy that I had had on a lump in my breast [00:23.680 --> 00:27.660] the day before I left for DEFCON had come back positive [00:27.660 --> 00:32.220] and I had breast cancer. I share this with you [00:32.220 --> 00:35.020] because it's what actually [00:35.660 --> 00:39.760] ended up starting the research that I did that I'm going to share with you today. [00:41.460 --> 00:43.700] For those of you who have never been [00:43.700 --> 00:47.920] through chemo or don't know anyone who's gone through it, I think most people know [00:47.920 --> 00:51.540] that the losing your hair, the throwing up, [00:51.540 --> 00:56.080] pretty much everyone knows about that, but there's a lot of other side effects that come with chemotherapy. [00:56.080 --> 01:00.120] And one of them is called chemo-brain. [01:00.520 --> 01:04.080] And the regimen that I was on was [01:04.080 --> 01:08.200] ACT, which is adriamycin, cytoxan, and [01:08.200 --> 01:12.260] taxol. And another name for adriamycin is doxorubicin [01:12.260 --> 01:15.620] hydrochloride. And that's the one that essentially [01:16.480 --> 01:20.200] pretty much kind of tries to destroy the mitochondria [01:20.200 --> 01:24.160] in your brain. It affects their energy levels and it results in [01:24.160 --> 01:27.980] forgetfulness, memory lapses, difficulty concentrating [01:27.980 --> 01:32.300] or focusing on tasks, trouble with recall, remembering words [01:32.300 --> 01:36.200] or names. My team can testify to the fact [01:36.200 --> 01:40.080] that there have been many of a time in a conference where I've been like trying [01:40.080 --> 01:44.100] to put a sentence together and I cannot recall normal [01:44.100 --> 01:48.100] everyday words that most people know. I can't pull them out of my head. [01:48.240 --> 01:51.820] I'm getting better at it, but it still happens. And then also [01:51.820 --> 01:55.240] struggling to do more than one task at a time. [01:57.140 --> 01:59.560] As a hacker, [01:59.560 --> 02:03.480] our mind is our most valuable tool. [02:03.840 --> 02:07.600] So losing my hair, my eyebrows, my eyelashes, [02:07.600 --> 02:11.600] even losing both breasts was not as traumatic [02:11.600 --> 02:15.300] or devastating to me as starting to lose my mind. [02:15.460 --> 02:19.740] So when the chemo ended, I kind of [02:19.740 --> 02:23.200] was hoping that it would just kind of all go back to normal and it didn't. [02:23.240 --> 02:27.700] So I started to try to research how to heal my brain. [02:28.280 --> 02:31.740] And in the process of that, I stumbled upon some research [02:31.740 --> 02:36.360] being done at Stanford, and I believe it was SRI International, they were partnered. [02:36.760 --> 02:39.800] And they were talking a lot about using the mind for authentication. [02:40.000 --> 02:43.860] And I kept kind of putting that to the side, like I really want to look at that [02:43.860 --> 02:47.800] but let's get this fixed first. Once I felt a little better about [02:47.800 --> 02:51.920] my own cognitive faculties, I went back and started looking at this research [02:51.920 --> 02:55.700] because I was very fascinated by this concept and I wanted to know [02:55.700 --> 02:59.740] how far along they were with it. How does it actually work? I mean, like [02:59.740 --> 03:03.920] really, how do you implant a password? How do you do this? [03:04.060 --> 03:07.620] So today I'm going to share kind of what I taught myself [03:07.620 --> 03:11.720] and what I've learned and kind of some of the, like, hackability [03:11.720 --> 03:15.720] of it or kind of the, like, where [03:15.720 --> 03:19.340] they're at with it as far as actually being a viable option. [03:20.960 --> 03:21.520] But... [03:22.760 --> 03:27.720] So a little about myself before I start. I'm a security engineer and researcher with [03:27.720 --> 03:31.800] Digital Cloak. And my undergrad is in sociology, which [03:31.800 --> 03:35.300] is a psychology of group behavior as opposed to the individual. [03:35.900 --> 03:39.780] My minor was deviancy, which has served me well [03:39.780 --> 03:43.700] in this environment. My grad work and degrees [03:43.700 --> 03:47.300] are in security management and cyber security. So I kind of came [03:47.300 --> 03:51.520] into the security arena from the cyber area kind of late, but [03:51.520 --> 03:55.640] it can be done. The agenda for this talk is going to kind of cover [03:55.640 --> 03:59.680] some conceptual groundwork so you can kind of understand some of the research [03:59.680 --> 04:03.820] when I share it. I still can't feel [04:03.820 --> 04:07.640] the ends of my fingers either. It's neuropathy. [04:09.380 --> 04:11.860] So last time I spoke at DEF CON I was [04:11.860 --> 04:16.020] actually fortunate enough to have one of the researchers I cited that attended [04:16.020 --> 04:20.100] my talk. So if any of the researchers I mention in my [04:20.100 --> 04:23.980] talk actually happen to be sitting here, like jump up and wave your [04:23.980 --> 04:27.720] arms so we can say hi and maybe have you come up and maybe [04:27.720 --> 04:30.580] tell us about your research better than I can maybe. [04:33.000 --> 04:35.980] So cognitive memory. This is [04:35.980 --> 04:40.100] cognition is the mental action or process of acquiring knowledge [04:40.100 --> 04:44.140] and understanding through thought, experience, or your senses or some combination [04:44.140 --> 04:48.380] of them. It's knowledge, attention, memory, judgment, [04:48.380 --> 04:52.200] evaluation, reasoning, problem solving, all of that. [04:52.200 --> 04:56.200] And it can be conscious or sub slash unconscious. [04:58.500 --> 04:58.900] It can be [05:01.760 --> 05:04.180] intuitive, which is the ability to [05:04.180 --> 05:07.860] acquire knowledge without understanding. So if you think of like instinct, [05:07.860 --> 05:11.920] or it can be conceptual, so based on ideas or concepts, like if you're [05:11.920 --> 05:17.690] in a classroom learning something. Consciousness can be [05:17.690 --> 05:21.830] defined from two different ways, biologically or philosophically. [05:21.830 --> 05:25.750] So your consciousness from a biological perspective refers to the idea [05:25.750 --> 05:29.690] of being like awake and aware of your surroundings and experiences [05:29.690 --> 05:33.590] in the people and things in your environment. And philosophically [05:33.590 --> 05:37.590] it can refer more to like having a soul or a sense of self. [05:37.590 --> 05:41.830] We're going to be focusing on the biologic consciousness here. [05:44.210 --> 05:45.590] Unconsciousness is when [05:45.590 --> 05:49.650] your ability to maintain an awareness of your environment or surrounding [05:49.650 --> 05:53.750] like stimulus is lost. And there's either a complete or near [05:53.750 --> 05:57.330] complete lack of responsiveness to your environment or any stimulus. [05:57.630 --> 06:01.790] There's a medical concept of being unconscious and a legal concept [06:01.790 --> 06:03.370] of being unconscious. [06:05.070 --> 06:07.230] So medically you can be [06:07.230 --> 06:10.430] unconscious kind of like from [06:11.210 --> 06:15.590] like a brain injury or perhaps like a drug induced [06:15.590 --> 06:18.710] unconsciousness that they'll do sometimes. [06:19.830 --> 06:23.150] But legally you can also be unconscious maybe if you're impaired [06:23.150 --> 06:27.610] from drugs or hypnosis or has anyone in here [06:27.610 --> 06:31.410] been like so tired that they just can't [06:31.410 --> 06:34.870] even anymore. You're awake and you're standing up and [06:35.410 --> 06:39.710] you're like able to function but your mind, you're just done. [06:39.890 --> 06:43.170] So that can kind of go into the area of like legally unconscious [06:43.170 --> 06:47.090] in a way. But I'm not a lawyer so don't try to use that in court. [06:49.490 --> 06:51.230] So Sigmund Freud in [06:51.690 --> 06:53.910] 1893 was the first to use the term [06:55.450 --> 06:59.270] subconscious. And what I thought was really interesting was when I was trying to figure out [06:59.270 --> 07:03.050] like where they really drew a line between subconscious and unconscious it turns out that [07:03.050 --> 07:07.030] Sigmund Freud actually used the terms interchangeably because in his native German [07:07.030 --> 07:11.270] it was kind of almost the same word. And now the argument seems [07:11.270 --> 07:15.350] to be more of a kind of a semantic grammatical thing [07:15.350 --> 07:18.830] than a definitive thing. In general [07:18.830 --> 07:23.050] unconsciousness typically tends to refer to a state of awareness from a medical perspective [07:23.050 --> 07:26.930] and subconscious tends to refer to an aspect of your psyche [07:26.930 --> 07:30.590] when discussing more of like a psychoanalytical environment. [07:31.250 --> 07:34.830] But if there's any shrinks in the audience who want to argue about it [07:34.830 --> 07:37.950] we can do that later. The best I can tell is [07:39.010 --> 07:42.930] it's more of a grammatical issue than a definitive one, but I am going to [07:42.930 --> 07:52.030] differentiate in them in this talk. So for now [07:52.030 --> 07:55.910] just think of subconscious as the part of your consciousness that is not currently in your [07:55.910 --> 07:59.830] focal awareness. And there was a psychologist named Edwin Locke who [07:59.830 --> 08:04.790] put it really well. I think he called it the alternative storehouse of knowledge and prior experience. [08:04.790 --> 08:07.650] And there's two main types of long-term human memory. [08:07.650 --> 08:11.030] We have explicit and implicit memory. [08:14.570 --> 08:18.310] That was my obligatory cat slide for DEF CON. [08:20.050 --> 08:21.490] Explicit memory is also known [08:21.490 --> 08:24.950] as declarative memory. It's conscious [08:24.950 --> 08:29.070] and there's two kinds, episodic and semantic. [08:30.950 --> 08:32.950] So episodic is more [08:32.950 --> 08:36.930] storing a personal experience like a kiss that really [08:36.930 --> 08:41.030] meant a lot to you or that you remember distinctly. And then semantic would be more like [08:41.030 --> 08:45.030] data about the kiss or a kiss. [08:49.280 --> 08:52.460] Implicit memory, is anyone here ride bikes [08:52.460 --> 08:56.440] or can you ride a bike? So that's kind of a good example. [08:56.440 --> 08:59.580] I do triathlons and we train constantly [08:59.580 --> 09:03.660] to get things into our implicit memory so that when you're [09:03.660 --> 09:07.260] in the middle of a race, it's just your instinct, it kind of takes over. [09:07.940 --> 09:11.940] So it's basically acquired and used unconsciously [09:11.940 --> 09:15.780] and it can affect your thoughts and behaviors. And this is kind of [09:15.780 --> 09:19.520] where when we get to talking about implanting, this is where they're putting [09:19.520 --> 09:23.320] the password. One of the most common forms is procedural [09:23.320 --> 09:28.620] which helps people performing certain tasks without awareness of actually performing it. [09:28.620 --> 09:32.060] People use explicit memory throughout the day like remembering an appointment [09:32.420 --> 09:35.740] or recalling an event from years ago. [09:37.180 --> 09:40.160] And implicit is more like an unintentional [09:40.160 --> 09:44.440] subconscious form. So if you remember a specific driving lesson [09:44.440 --> 09:48.460] you had, that's an example of explicit memory. But if your driving [09:48.460 --> 09:52.280] skill improves as a result of that lesson, that is more the [09:52.280 --> 09:56.520] implicit memory. Okay, memory is a tool [09:56.520 --> 09:58.440] versus memory is an object. [10:00.540 --> 10:04.280] They've put forth that you can use it kind of both ways. So memory is treated as an object [10:04.280 --> 10:08.060] when you're recalling or recognizing like an actual memory [10:08.060 --> 10:12.580] but then if you're talking about using it to serve as an authenticator [10:12.580 --> 10:16.760] this is more like where you would use it as a tool. And so why is this important? [10:16.760 --> 10:20.020] Because they're looking at this research as being considered [10:21.040 --> 10:25.140] potentially a subclass of behavioral biometric measurement. [10:26.640 --> 10:29.060] So this is where we're going to start to connect with the idea of [10:29.060 --> 10:33.860] implanting passwords as an option. So we're going to talk about encoding, storage, and retrieval. [10:35.300 --> 10:36.940] So with encoding, this is [10:36.940 --> 10:41.120] processing information into the memory. And there's several different ways [10:41.120 --> 10:44.920] of encoding information. There's structural encoding, which is how something [10:44.920 --> 10:49.180] looks. And an example would be if you had a word. Is it long? Is it [10:49.180 --> 10:53.720] short? Is it all uppercase or lowercases? Is it handwritten? Is it typed? [10:53.720 --> 10:57.760] Then mnemonic encoding is how something sounds. So like how does a certain word [10:57.760 --> 11:01.600] sound? And then semantic encoding focuses more on the meaning. [11:01.600 --> 11:05.760] And it requires a deeper level of processing than structural or mnemonic. [11:05.880 --> 11:09.780] And it usually results in a better memory because you're kind of creating an association. [11:11.320 --> 11:13.660] Storage is after the information enters [11:13.660 --> 11:18.400] your brain, it has to be stored or maintained or forgotten. [11:21.380 --> 11:23.560] So there's a three stage model that was [11:23.560 --> 11:27.560] proposed by Richard Atkinson and Richard Shiffrin. It's often used to describe this [11:27.560 --> 11:31.820] process. This is my attempt to make a representation of it. [11:32.240 --> 11:35.500] So essentially you have sensory memory, [11:35.500 --> 11:39.640] short term memory, and long term memory. Sensory memory stores the incoming sensory [11:39.640 --> 11:43.640] information in detail, but only for an instant. The capacity is very large [11:43.640 --> 11:47.560] but the information in it is unprocessed. Visual sensual memory [11:47.560 --> 11:52.260] is iconic memory. And auditory sensory memory is called echoic memory. [11:52.260 --> 11:56.440] So then you get to short term memory and some of the information in sensory [11:56.440 --> 12:00.240] memory can transfer into short term memory and that can hold information for [12:00.240 --> 12:04.440] about 20 seconds. And rehearsing is a way that you can [12:04.440 --> 12:08.220] kind of keep information in your short term memory longer. So an example [12:08.220 --> 12:12.240] is like if someone, like if you're parking your car and you're trying to remember like where did you [12:12.240 --> 12:16.760] park your car and you're walking to whatever and you're like P2, P2, P2, [12:16.760 --> 12:20.600] it's kind of like a way to kind of keep it in your mind and get it in there a little better. [12:20.600 --> 12:24.500] Short term memory has a limited capacity and it can store about seven [12:24.500 --> 12:28.720] pieces of information, give or take. And these pieces of information can be [12:28.720 --> 12:32.420] small, such as like individual numbers or letters, or larger like [12:32.420 --> 12:36.600] familiar strings of numbers or words. So like if you're trying to remember the word cat, [12:36.600 --> 12:40.920] you're not going to remember C-A-T, you're going to remember the word cat [12:40.920 --> 12:43.100] with the visual. [12:45.740 --> 12:48.740] So information can be kept in your working memory [12:48.740 --> 12:52.600] while you process or examine it. And then once you're done with it, it either [12:52.600 --> 12:56.220] is pretty much forgotten or it moves into your long term memory. [12:56.460 --> 13:00.760] Long term memory has an almost infinite capacity and the information [13:00.760 --> 13:04.800] usually stays there for the duration of a person's life. However, the [13:04.800 --> 13:08.780] big issue is it's there, but you're not always able to retrieve it, [13:08.780 --> 13:13.260] which is where the chemo kind of affected me was the data was in there, [13:13.260 --> 13:16.860] I was just not able to pull it out and that's what I was struggling with. [13:17.800 --> 13:20.740] So with retrieval, that's the process of getting the information [13:20.740 --> 13:24.640] out of your memory. And they have these retrieval cues and those are [13:24.640 --> 13:29.420] stimuli that can kind of help you remember. And they include associations, [13:29.420 --> 13:30.900] context, and mood. [13:33.260 --> 13:36.780] So context is you can try to remember [13:36.780 --> 13:40.400] an event by putting yourself in the same context you were when it happened. [13:40.480 --> 13:44.380] Such as if someone lost a paddle from last night [13:44.380 --> 13:47.380] and they're trying to remember where it is. [13:47.780 --> 13:52.380] Sorry, that was for my boss. They could kind of go back to where they remember [13:52.380 --> 13:56.140] they had it last and walk through if they can remember where they went next [13:56.140 --> 14:00.280] and see if they can find it. Or you can do the same with your car keys if you've ever lost them. [14:01.800 --> 14:04.520] Associations, this is our equal opportunity, gratuitous, [14:04.520 --> 14:08.460] sexy photos. I hope I hit most everyone in the audience. [14:09.900 --> 14:12.580] If not, I'm so sorry, but I only had so many [14:12.580 --> 14:16.600] slides and so much time. But the brain stores information as networks [14:16.600 --> 14:20.220] of associated concepts. So recalling a particular word can be easy [14:20.220 --> 14:24.780] if another related word is recalled first. So here's an example [14:24.780 --> 14:28.720] if I show you guys like these sunbathers on the beach and then I ask you [14:28.720 --> 14:32.280] to spell the word bear, you may be more likely to spell [14:32.280 --> 14:36.680] B-A-R-E instead of B-E-A-R because the picture [14:36.680 --> 14:40.700] kind of primed you and associated you to that particular spelling. [14:40.700 --> 14:44.940] And then there's mood. So if you're in the same mood you were during a particular [14:44.940 --> 14:49.220] event, you can have maybe an easier time recalling the event, like kind of a [14:49.220 --> 14:53.380] nostalgia type thing if you think about it. [14:53.380 --> 14:57.340] Here's our other cat. They told me I had to put so many cats [14:57.340 --> 15:01.420] in and so many sexy photos, so I tried to make sure I got them all. [15:01.420 --> 15:05.380] Next slide. Okay, the human brain [15:05.600 --> 15:08.480] has about a billion neurons in it and each neuron forms about a thousand [15:08.480 --> 15:12.500] connections. And this is about somewhere around a trillion [15:12.500 --> 15:16.480] connections I think. The challenge is if each neuron could only store [15:16.720 --> 15:20.540] a single memory, running out of space would be a huge problem. So you might only [15:20.540 --> 15:24.520] have maybe a few gigabytes of storage space, like about the same as an iPod or [15:24.620 --> 15:28.600] a USB flash drive, but because the neurons combine so that each one helps [15:28.600 --> 15:32.780] with many memories at a time, it exponentially increases your brain's [15:32.780 --> 15:36.680] memory storage capacity to something closer to about 2.5 petabytes. [15:36.680 --> 15:40.620] And the example, I think it was something like 300 million [15:41.280 --> 15:44.680] hours of television [15:44.680 --> 15:48.600] shows is about the capacity to store in there because of the way the neurons can [15:48.600 --> 15:54.100] connect. Time check? [15:54.280 --> 15:58.500] Alright, there are some limitations to memory. [15:58.640 --> 16:02.560] I think everyone in here has seen that gorilla basketball video. [16:02.900 --> 16:07.020] So that's like inattentional blindness or the illusion of attention. You focus so much [16:07.020 --> 16:10.200] on one thing, you completely miss other stuff going on. [16:11.200 --> 16:15.000] Sorry. There's false memories. There's the [16:15.000 --> 16:18.660] illusion of confidence, which interestingly enough, apparently that's the opposite of [16:18.660 --> 16:22.980] imposter syndrome. They have one. The illusion of [16:22.980 --> 16:27.020] cause. There's a tendency to make casual connections between related facts [16:27.020 --> 16:29.120] that maybe are not accurate. [16:33.410 --> 16:36.190] This is where I want to get into the research. [16:37.310 --> 16:40.230] One word, concept, vocabulary thing is called brain [16:40.230 --> 16:44.290] computer interface. So the initial motivation behind brain computer [16:44.290 --> 16:48.810] interfaces was to develop the communication devices for the severely disabled. [16:48.870 --> 16:52.390] Seeing as that I only have a limited time to speak, I won't go into the deep dive [16:52.390 --> 16:56.190] about how an individual can train their mu and beta brain waves to [16:56.190 --> 17:00.150] control a cursor. And there's some fascinating stuff around visual evoked [17:00.150 --> 17:04.130] potentials. But there's a plethora of research out there if you're super [17:04.130 --> 17:08.110] interested in that level of granularity. But I did want [17:08.110 --> 17:11.390] to point out there is some research by Dr. J.R. Wolpow [17:12.110 --> 17:16.290] and his research team as a starting point. And then Dr. Niels [17:16.290 --> 17:19.770] Birbaumer with the thought translation device. He's with the [17:19.770 --> 17:24.210] University of Tübingen in Germany. And he has created this device [17:24.210 --> 17:27.830] that allows users to compose phrases and sentences electronically [17:27.830 --> 17:32.170] just by thinking them. So he's neat. And you may also want to [17:32.170 --> 17:36.230] look at a paper out of Dartmouth College about the Neurophone. It's a brain [17:36.230 --> 17:40.230] mobile phone interface using a wireless EEG headset. And [17:40.230 --> 17:44.010] in their paper his team shares the details of a brain controlled address [17:44.010 --> 17:48.170] book dialing app they created. So the point is this is a super [17:48.170 --> 17:51.970] huge area of research. But I haven't heard a lot of it on kind of our side of the house [17:51.970 --> 17:56.190] as far as the security of these things. But I did want to share the four key pieces [17:56.190 --> 17:59.830] of research that I found to be the most interesting and with the most potential. [18:05.570 --> 18:07.050] First there's this... [18:07.050 --> 18:12.000] wait, go back. So first [18:12.840 --> 18:17.220] I'm going to murder this man's name, so I apologize ahead of time, but Hristo Bojanov [18:17.220 --> 18:21.360] at Stanford was working with some cognitive scientists at Northwestern [18:21.360 --> 18:25.020] University and they designed a game that looks similar to Guitar Hero. [18:25.260 --> 18:29.040] And this is called CISL, Serial Interception Sequence Learning. [18:29.460 --> 18:33.180] And it's an authentication procedure that [18:33.180 --> 18:37.400] they created this testing experiment around. And they used Mechanical Turk [18:37.400 --> 18:40.980] through Amazon to do their experiments. So [18:41.440 --> 18:45.080] I'm not sure how well that looks as far as like [18:45.080 --> 18:49.160] how you're able to look at your subject pool from an experimental perspective. [18:52.010 --> 18:55.370] I'm trying. I'm like all up on it. I do want [18:55.370 --> 18:59.350] to walk you through how it works, but I want to make sure I get it right, so I want to [18:59.350 --> 19:03.470] read it. The process of learning the password involves the use of a specially [19:03.470 --> 19:07.350] crafted computer game that resembles Guitar Hero. There are six buttons [19:07.350 --> 19:11.350] S, D, F, J, K, and L. And the user has to hit the [19:11.350 --> 19:15.770] corresponding key or note when the circle reaches the bottom fret. [19:15.770 --> 19:19.430] So during a typical training session of around 45 minutes, [19:19.650 --> 19:22.830] a user will make about 4,000 keystrokes. And around [19:22.830 --> 19:27.330] 80% of these keystrokes are being used to subconsciously teach you a 30 [19:27.330 --> 19:35.830] character password. Before running, [19:35.830 --> 19:39.670] the game creates a random sequence of 30 letters chosen from the [19:39.670 --> 19:43.730] S, D, F, J, K, and L with no repeating characters. This equates [19:43.730 --> 19:47.830] to around 38 bits of entropy. And the 30 character [19:47.830 --> 19:51.850] sequence is played back to the user three times in a row and then padded out [19:51.850 --> 19:55.490] with 18 random characters for a total of 108 items. [19:55.650 --> 19:59.950] The sequence is repeated five times, and then there's a short pause, and the entire process [19:59.950 --> 20:03.810] is repeated six more times. And by this point, the experimental results [20:03.810 --> 20:07.830] suggest that a 30 letter password is firmly implanted in your [20:07.830 --> 20:11.750] subconscious brain. The authentication requires that you play a round [20:11.750 --> 20:15.850] of the game, but this time your 30 letter sequence is interspersed with other [20:15.850 --> 20:19.850] random 30 letter sequences. To pass the authentication, you have [20:19.850 --> 20:23.710] to reliably perform your sequence. The research shows that [20:23.710 --> 20:26.850] even after two weeks, you're able to recall the sequence. [20:28.610 --> 20:31.850] The next one is past thoughts. So this is from [20:31.850 --> 20:35.710] Berkeley, 2013. This technique combines [20:35.710 --> 20:39.730] three factors. Something you know, which is a thought, something you [20:39.730 --> 20:43.830] are, your brain patterns, and then something you have, which is the EEG sensor for [20:43.830 --> 20:47.970] measuring the brain waves. To authenticate with a past thought, you think your secret [20:47.970 --> 20:51.810] key while using the sensor. The key can be just about anything, [20:51.950 --> 20:56.050] a song, a phrase, or a mental image, and the thought itself is never transmitted, [20:56.050 --> 20:59.890] just a mathematical representation of the electrical signals your brain makes [20:59.890 --> 21:05.860] while you think it. Now, if someone else were to figure [21:05.860 --> 21:09.820] out what you were thinking, they still couldn't impersonate your past thought in theory [21:09.820 --> 21:13.040] because every person thinks the same thing differently. [21:13.420 --> 21:17.720] So, you know, we could all think about the same song, but we're not [21:17.720 --> 21:21.480] all going to think about it exactly the same way as far as being registered [21:21.480 --> 21:25.700] electronically. Time check. Okay, so [21:25.700 --> 21:29.680] this is how they did this one. The following tasks were repeated five times in [21:29.680 --> 21:33.620] each session for each subject. They had a breathing task, so [21:33.620 --> 21:37.760] they had to close their eyes and focus on their breathing for 10 seconds. They had a simulated [21:37.760 --> 21:41.700] finger movement, so subjects imagined in their mind that they were moving [21:41.700 --> 21:45.540] their right index finger up and down in sync with their breathing without actually [21:45.540 --> 21:49.360] moving their finger. There was a sports task where they selected [21:49.740 --> 21:53.700] a repetitive motion from a sport of their choosing, and they imagined moving their body [21:53.700 --> 21:57.440] muscles to perform the motion. Then there was a song passage [21:57.440 --> 22:01.660] recitation task, an eye audio tone task, an object [22:01.660 --> 22:05.540] counting task, and then at the very end they had a past thought [22:05.540 --> 22:08.920] which they were asked to choose their own past thought like [22:09.440 --> 22:13.180] a password, but instead of choosing a sequence of letters or numbers, they thought [22:13.180 --> 22:17.480] of a thought, like a vision of their wedding, or their child being [22:17.480 --> 22:21.060] born, or the first time they got drunk, or what have you. And that [22:21.060 --> 22:25.280] they had to think about that for 10 seconds, and then everything together became their [22:25.280 --> 22:32.910] past thought. So this was some other interesting [22:32.910 --> 22:37.110] research that was done that kind of fed into the next one. It was on the feasibility [22:37.110 --> 22:40.410] of side-channel attacks with brainwave computer interfaces. [22:41.230 --> 22:45.050] I do have these papers cited at the end of my slide deck, [22:45.050 --> 22:49.010] so if you look them up on the torrent, they'll be there. But it studied [22:49.010 --> 22:53.090] the possibility of side-channel attacks using commercial EEG types of headsets [22:53.090 --> 22:57.290] to reveal users' personal information like their banks, [22:57.290 --> 23:01.330] ATMs, or PIN digits. Their approach was similar to a guilty knowledge test [23:01.330 --> 23:05.290] where items familiar to a user are assumed to evoke different responses as compared [23:05.290 --> 23:09.170] to items that are unfamiliar. So for example, when a person was shown images [23:09.170 --> 23:13.030] of many banks, the brain response to the image of their bank [23:13.030 --> 23:17.150] had more of an interaction or evoked a higher [23:18.210 --> 23:21.350] potential with the waves. The problem with their attack [23:21.350 --> 23:25.130] setup, it was intrusive and it could be easily detected by the user, [23:25.130 --> 23:29.330] but that brought us to PEEP. So PEEP [23:29.330 --> 23:33.130] built upon their research, and what they tried to do was create [23:33.130 --> 23:37.450] an actual keylogger-slash-malware. [23:37.490 --> 23:41.110] And this actually was on phys.org in June [23:41.110 --> 23:44.730] 29th, and I'll read from the article. It's a quote. [23:44.730 --> 23:49.270] Researchers at the University of Alabama at Birmingham suggested that brainwave [23:49.270 --> 23:52.790] sensing headsets, also known as EEG, need [23:52.790 --> 23:57.210] better security after a study reveals hackers could guess a user's [23:57.210 --> 24:01.130] passwords by monitoring their brainwaves. So in contrast [24:01.130 --> 24:04.850] to the research I mentioned on the previous slide, the folks [24:04.850 --> 24:08.970] at the University of Alabama wanted to test out a more surreptitious, [24:08.970 --> 24:12.890] less intrusive approach that only required passive monitoring of brain [24:12.890 --> 24:16.870] signals as the user's type pins or passwords. And so they called theirs [24:16.870 --> 24:20.890] PEEP, which is passively eavesdropping private input [24:20.890 --> 24:24.610] via brainwave signals. And this was University of Alabama [24:24.610 --> 24:28.170] and I think one gentleman from California Riverside. [24:29.890 --> 24:32.790] Now, they extensively referenced [24:32.790 --> 24:37.030] the research of the previous group with the side channel [24:37.030 --> 24:40.790] attacks, and they named their keylogger PEEP. And so [24:40.790 --> 24:44.970] according to their paper, as the use of these devices, which they're [24:44.970 --> 24:48.790] referring to the EEG gaming and entertainment devices, headsets, for any of you who [24:48.790 --> 24:52.710] game, it becomes mainstream. A user may enter passwords or [24:52.710 --> 24:56.810] private credentials to their computers or their mobile phones while they're wearing these [24:56.810 --> 25:00.430] devices. And so they were studying the potential of [25:00.430 --> 25:03.850] introducing a malicious app to capture those EEG signals [25:03.850 --> 25:08.990] and then process the signals to infer the sensitive keystrokes. [25:09.310 --> 25:12.310] So the gentleman and his team [25:12.310 --> 25:16.930] used one regular store-bought EEG headset that anyone could buy at [25:16.930 --> 25:20.610] or what have you. And then they also used a clinical grade headset [25:20.610 --> 25:24.750] in their experiment. And they were able to demonstrate how easy a malicious software [25:24.750 --> 25:28.730] program could passively eavesdrop on your brainwaves. So while [25:28.730 --> 25:32.890] typing your inputs, it could sense [25:32.890 --> 25:36.730] all of this. And I think he saw a quote from the article, [25:36.730 --> 25:40.690] in a real-world attack, a hacker could facilitate the training step required for the [25:40.690 --> 25:44.590] malicious program to be the most accurate by requesting that the user [25:44.590 --> 25:48.630] enter a predefined set of numbers in order to restart the game after pausing [25:48.630 --> 25:52.250] it to take a break, similar to the way a CAPTCHA is used to verify [25:52.250 --> 25:56.510] certain users are logging in. The research showed that after a user [25:56.510 --> 26:00.810] entered 200 characters, algorithms within the malicious software [26:00.810 --> 26:04.570] program could make educated guesses about new characters the user entered by [26:04.570 --> 26:08.710] monitoring the EEG data recorded. The algorithm they created was [26:08.710 --> 26:12.330] able to shorten the odds of a hacker guessing a four-digit numerical pin [26:12.330 --> 26:15.950] from 1 in 10,000 to 1 in 20, [26:15.950 --> 26:20.110] and increase the chance of guessing a six-letter password from about 1 in [26:20.110 --> 26:23.250] 500,000 to roughly 1 in 500. [26:31.760 --> 26:32.880] So... security [26:32.880 --> 26:36.940] posture versus a rubber hose type of cryptoanalysis. The challenge [26:36.940 --> 26:40.800] in testing their hypothesis is that as far as I know, [26:40.800 --> 26:44.840] especially at Stanford, there's no studies that actually allow you to beat people [26:44.840 --> 26:49.000] during an experiment. So I think in a way [26:49.000 --> 26:53.140] they were kind of sexifying their paper title. You know, no shade. [26:53.200 --> 26:56.680] But after a long discussion with a psychologist friend, my current opinion [26:56.680 --> 27:01.020] with CICEL, which is the guitar hero in past thoughts, is there seems [27:01.020 --> 27:05.840] to be some dependence on the consistency of the entry of the authentication, [27:05.840 --> 27:08.960] and by introducing an actual rubber hose type attack [27:08.960 --> 27:12.920] or some other similarly traumatic level of extraction, this [27:12.920 --> 27:16.900] could affect the brainwaves themselves. So the ability to perform the [27:16.900 --> 27:21.580] action or the entry in a manner consistent with the password was set up. [27:21.600 --> 27:24.920] It could affect that, thus rendering it, you know, even if you [27:24.920 --> 27:29.080] have it, it's not going to work because it's not matching the brainwaves. Because if you're relaxed [27:29.080 --> 27:33.040] when you're going through the implantation, but you're being beaten with a rubber [27:33.040 --> 27:37.460] hose, even if they get the string, it's going to be different. [27:38.420 --> 27:40.920] So starting with the CICEL or [27:40.920 --> 27:45.020] the guitar hero, they were able to test retrieval, but not [27:45.020 --> 27:48.980] under stress or trauma. And they were able to test [27:48.980 --> 27:53.140] basic coercion, trying to fool [27:53.140 --> 27:56.860] the system, and that went pretty well. The potential [27:56.860 --> 28:00.980] attacks against that one involved the use of remote authentication approach, whether or not [28:00.980 --> 28:04.840] the attacker is allowed multiple extraction attempts, if there's performance [28:04.840 --> 28:09.000] gaps, eavesdropping, none of this stuff's been tested, just the retrieval [28:09.000 --> 28:13.160] has been tested. With past thoughts, [28:13.240 --> 28:16.960] a hacker might be able to defeat the system by using a phishing scheme that would trick you into [28:16.960 --> 28:21.460] thinking your past thought, capturing the output, and maybe later playing it back. [28:22.460 --> 28:25.060] And it was pointed out by the research team that [28:25.060 --> 28:28.980] the approach being used by them and the side channel attacks [28:32.220 --> 28:33.120] my brain just [28:33.120 --> 28:37.060] went dead. The stuff [28:37.060 --> 28:40.880] is generated for implantation with a random generator [28:40.880 --> 28:44.960] so you could probably go after it from the source by [28:44.960 --> 28:48.600] going after the random generator that issues it versus [28:48.600 --> 28:51.860] the actual person who has it, if that makes sense. [28:56.800 --> 29:00.780] As to CICEL and past thoughts, they're still in a mostly theoretical stage [29:00.780 --> 29:04.920] as far as research and experimentation goes. I didn't [29:04.920 --> 29:08.900] really see anyone addressing how memory could be affected by such things as drug [29:08.900 --> 29:13.160] use or injury or even degradation, such as if you have an employee [29:13.160 --> 29:16.940] that's going through chemo and suddenly their brain is affected, would [29:16.940 --> 29:20.820] they even be able to use any of this? Would that affect [29:20.820 --> 29:22.720] the authentication pattern? [29:24.180 --> 29:28.940] I don't really see this being viable for use at large right now until [29:28.940 --> 29:30.980] some of those questions are answered. [29:34.280 --> 29:36.940] We're all here at DEF CON, so what happens if you [29:36.940 --> 29:40.940] have the password implanted while you're sober at work [29:40.940 --> 29:44.960] but then you've had a couple drinks and you need to finish a proposal, are you going [29:44.960 --> 29:49.200] to be able to authenticate or will being drunk or kind of drunk [29:49.200 --> 29:53.120] or even just slightly impaired affect that ability? And that was another [29:53.120 --> 29:57.000] thing I didn't see addressed. Cost was [29:57.000 --> 30:01.140] another big thing. It's all well and good to propose this, but what's the exact cost [30:01.140 --> 30:04.840] associated with implementing something like this? And would it be [30:04.840 --> 30:09.040] realistic to deploy? So with SISL, the training or encoding [30:09.040 --> 30:12.740] time was noted to be 45 minutes. And with [30:12.740 --> 30:16.860] PastThoughts, it was two 40-50 minute sessions. And so if [30:16.860 --> 30:20.760] you have a small organization, 5-10 people, that might be [30:20.760 --> 30:24.660] okay, but I'm trying to picture Lockheed Martin or something trying to do this [30:24.660 --> 30:28.840] with thousands of people trying to put each one of them through [30:28.840 --> 30:32.620] that. With SISL, there are certain people [30:32.620 --> 30:36.540] this probably would work best with, but factors such as mental capacity [30:36.540 --> 30:40.740] or psychological issues. My sister-in-law works with [30:40.740 --> 30:44.680] special needs adults who do stuff at the airport and have to go through security [30:44.680 --> 30:49.260] checkpoints. So especially with the Guitar Hero type of thing, [30:49.260 --> 30:52.560] would there be certain people that just wouldn't be able to authenticate [30:52.560 --> 30:56.660] this way? Just legitimately, from a handicap perspective, they can't [30:56.660 --> 31:00.640] do it. Even some of our wounded warriors who [31:00.640 --> 31:04.200] don't have hands to do this [31:04.200 --> 31:09.060] intricate type of authentication. And then things like Parkinson's [31:09.060 --> 31:12.780] seizures, what if the individual is blind and can't even see? [31:12.780 --> 31:16.840] I didn't really see any of this addressed as far as using it in a [31:16.840 --> 31:20.900] real world on a large scale. All in all, I think [31:20.900 --> 31:26.700] it's fascinating with potential, but the research is still in a pretty early stage. [31:26.700 --> 31:28.580] The sample groups also, if anyone here [31:28.580 --> 31:32.620] grad school, scientific research, test groups, [31:32.620 --> 31:36.720] so the CISIL-CISE experiment number one was done [31:36.720 --> 31:40.640] with 35 participants. Number two had two [31:40.640 --> 31:44.800] groups, 32 and 80 participants, for a total of 147, [31:44.800 --> 31:48.680] but they didn't clarify if any of those were duplicates from the first [31:48.680 --> 31:52.780] to second experiment, so it actually might have been a smaller group number. [31:54.020 --> 31:56.720] Based on my own experience, I'm not sure 147 [31:56.720 --> 32:01.000] represents a solid sample, other than whether or not it warrants further study. [32:01.000 --> 32:05.360] I do think it warrants further study, but so far it's still very theoretical. [32:05.360 --> 32:08.740] The past thoughts material I read was based on research on [32:08.880 --> 32:12.120] a group of a total of 15 subjects. [32:12.460 --> 32:16.460] The side channel attack research had 28 subjects, and the [32:16.460 --> 32:20.620] PEEP research had a whopping 12 subjects. [32:20.640 --> 32:24.700] So again, this is still really kind of in very theoretical [32:24.700 --> 32:28.560] stage, and a pool of 12 subjects to me [32:28.560 --> 32:33.400] is not a huge sample size from a research perspective, [32:33.400 --> 32:36.540] except for maybe to do further research. [32:36.840 --> 32:41.820] My thoughts around hackability, CISIL refers to the rubber hose, [32:41.820 --> 32:44.820] I just really don't see that, [32:44.820 --> 32:48.680] I don't see how they really addressed it, I think they just used the word [32:48.680 --> 32:52.640] because it sounded cool. The theory that the [32:52.640 --> 32:56.620] knowledge is not consciously accessible to the individual, I'm still [32:56.620 --> 33:00.660] not sure on that. I have a psychologist friend, and he's [33:00.660 --> 33:04.880] in agreement with me, like, if you can put it in, you can take it out. [33:05.560 --> 33:07.860] And there's ways to do that. [33:09.660 --> 33:12.560] For CISIL, a good potential attack factor might be [33:13.060 --> 33:17.100] again, like I said, the random number generator, or the random password generator. [33:17.160 --> 33:20.660] And in their paper, the past thought team pointed out they were not [33:20.660 --> 33:24.560] vulnerable to shoulder surfing because their system was invisible, [33:24.560 --> 33:28.420] but they felt they were very vulnerable to both social engineering and dictionary attacks [33:28.420 --> 33:32.500] as their system stood. However, it was their hope that with advances in signal [33:32.500 --> 33:36.600] recording and processing technology, it would allow for a much more detailed capture of the thought [33:36.600 --> 33:41.340] itself, and that would protect better against some of the dictionary attacks. [33:41.340 --> 33:44.980] And they also felt they were fairly vulnerable to phishing attacks, [33:44.980 --> 33:48.700] where if you could get someone to click on something and record their thoughts [33:48.700 --> 33:52.480] while they were clicking, they were kind of vulnerable from that perspective. [33:53.500 --> 33:56.540] CISIL's not designed to prevent eavesdropping or shoulder surfing [33:56.540 --> 34:00.480] attacks, so I imagine a good video recording of them [34:00.480 --> 34:04.380] performing the sequence could allow an attacker to replicate it. [34:04.380 --> 34:08.880] And considering how many security video cameras are insecure, [34:08.880 --> 34:12.640] this is definitely a distinct possibility. And I believe they did say that [34:12.640 --> 34:15.820] in some of the experiments, the [34:15.820 --> 34:20.020] error ratio was just enough that if someone [34:20.020 --> 34:24.020] knew that person's sequence, there were times they were able to [34:24.020 --> 34:25.420] impersonate it. [34:27.340 --> 34:31.620] I talked to my psychologist friend about using hypnosis [34:31.620 --> 34:35.840] to potentially extract it. That I've done a little more research [34:35.840 --> 34:39.100] into, and I'm not sure that's really a viable vector. [34:39.480 --> 34:43.740] But he and I are actually still discussing that at length, so maybe I'll have more on that [34:43.740 --> 34:47.680] in the future. Another thing, CISIL's a flash application. [34:48.500 --> 34:51.140] So I'll just put that right there. [34:53.820 --> 34:55.620] That was my first big like, [34:55.620 --> 34:58.700] okay. And CISIL's authentication [34:58.700 --> 35:03.020] process is potentially vulnerable to attack [35:03.740 --> 35:07.320] if even an untrained person is able to [35:08.600 --> 35:11.620] mimic or degrade their performance to match [35:11.620 --> 35:14.100] the person they've watched authenticate. [35:16.860 --> 35:19.640] And then the authentication based on keystroke dynamics [35:19.640 --> 35:23.620] is similar to authentication based on the past thoughts. [35:24.880 --> 35:26.940] So it looks at their typing rhythm [35:27.620 --> 35:30.620] and what they're thinking at the same time. [35:32.260 --> 35:36.300] So I think they just still need to do more research. [35:36.480 --> 35:39.400] So in closing, I think much of this is still in the experimental [35:39.400 --> 35:43.420] stage, and it's going to be really interesting to see if anything actually comes of it, [35:43.420 --> 35:47.460] especially considering trying to deploy it across a large [35:48.140 --> 35:51.440] environment or organization, or a very [35:51.440 --> 35:55.340] varied population, like a bigger sample size than 12. [35:57.040 --> 35:58.260] Check my time. [35:59.840 --> 36:03.440] Some of my research, I have the papers. There are links [36:03.440 --> 36:07.520] to them, but you don't have to click them. You can just Google the name of the [36:07.520 --> 36:10.680] paper in Google Scholar. It'll come right up. [36:12.440 --> 36:15.680] And then the last thing I wanted to leave you with is [36:15.680 --> 36:19.020] it was kind of interesting, about halfway through my research [36:19.020 --> 36:23.280] someone mentioned to me, oh my god, have you read this? It's a book called [36:23.280 --> 36:27.180] Hard Boiled Wonderland and the End of the World. [36:27.180 --> 36:31.220] And it was written by Haruki Murakami. [36:31.300 --> 36:34.900] And it's actually from 1985. [36:36.640 --> 36:38.920] And what I thought was really interesting is [36:38.920 --> 36:42.840] I'm not going to spoil it if you want to read it, but it's a parallel narrative [36:42.840 --> 36:47.520] type setup. One of the narrators is called a calcutech. [36:47.520 --> 36:50.460] And it's a human data processor encryption system [36:50.460 --> 36:55.220] who's been trained to use their subconscious as an encryption key. [36:55.780 --> 36:59.080] And the other narrator is a newcomer to a strange [36:59.080 --> 37:02.920] isolated town. And I'll leave it there so I don't spoil it. [37:02.920 --> 37:06.700] But if you find this interesting, I actually thought it was pretty fascinating [37:06.700 --> 37:09.780] that back in 1985, even [37:10.800 --> 37:14.700] fantasy authors were thinking about the idea of using the mind to authenticate [37:14.700 --> 37:18.920] and for encryption. So that's all I have. [37:19.640 --> 37:22.720] I can do questions now if anyone has them.