WEBVTT 00:00.000 --> 00:09.560 Two years ago, I was sitting in the Paris hotel, the Thursday morning that DEFCON was to start, and my phone rang. 00:10.100 --> 00:15.460 And I was a little nervous to answer it because I kind of knew what the phone call was about. 00:15.940 --> 00:29.280 And it was my doctor calling me back to tell me that the biopsy that I had had on a lump in my breast the day before I left for DEFCON had come back positive and I had breast cancer. 00:30.280 --> 00:39.760 I share this with you because it's what actually ended up starting the research that I did that I'm going to share with you today. 00:41.460 --> 00:56.080 For those of you who have never been through chemo or don't know anyone who's gone through it, I think most people know that the losing your hair, the throwing up, pretty much everyone knows about that, but there's a lot of other side effects that come with chemotherapy. 00:56.080 --> 01:00.120 And one of them is called chemo-brain. 01:00.520 --> 01:09.220 And the regimen that I was on was ACT, which is adriamycin, cytoxan, and taxol. 01:09.220 --> 01:13.200 And another name for adriamycin is doxorubicin hydrochloride. 01:13.200 --> 01:20.960 And that's the one that essentially pretty much kind of tries to destroy the mitochondria in your brain. 01:20.960 --> 01:33.880 It affects their energy levels and it results in forgetfulness, memory lapses, difficulty concentrating or focusing on tasks, trouble with recall, remembering words or names. 01:34.180 --> 01:46.000 My team can testify to the fact that there have been many of a time in a conference where I've been like trying to put a sentence together and I cannot recall normal everyday words that most people know. 01:46.000 --> 01:48.100 I can't pull them out of my head. 01:48.240 --> 01:51.180 I'm getting better at it, but it still happens. 01:51.280 --> 01:55.240 And then also struggling to do more than one task at a time. 01:57.140 --> 02:03.480 As a hacker, our mind is our most valuable tool. 02:03.840 --> 02:15.300 So losing my hair, my eyebrows, my eyelashes, even losing both breasts was not as traumatic or devastating to me as starting to lose my mind. 02:15.460 --> 02:23.200 So when the chemo ended, I kind of was hoping that it would just kind of all go back to normal and it didn't. 02:23.240 --> 02:27.700 So I started to try to research how to heal my brain. 02:28.280 --> 02:36.360 And in the process of that, I stumbled upon some research being done at Stanford, and I believe it was SRI International, they were partnered. 02:36.760 --> 02:39.800 And they were talking a lot about using the mind for authentication. 02:40.000 --> 02:45.940 And I kept kind of putting that to the side, like I really want to look at that but let's get this fixed first. 02:46.160 --> 02:57.700 Once I felt a little better about my own cognitive faculties, I went back and started looking at this research because I was very fascinated by this concept and I wanted to know how far along they were with it. 02:57.780 --> 02:59.320 How does it actually work? 02:59.320 --> 03:02.600 I mean, like really, how do you implant a password? 03:02.720 --> 03:03.920 How do you do this? 03:04.060 --> 03:19.340 So today I'm going to share kind of what I taught myself and what I've learned and kind of some of the, like, hackability of it or kind of the, like, where they're at with it as far as actually being a viable option. 03:20.960 --> 03:21.520 But... 03:22.760 --> 03:25.660 So a little about myself before I start. 03:25.660 --> 03:29.100 I'm a security engineer and researcher with Digital Cloak. 03:29.180 --> 03:35.300 And my undergrad is in sociology, which is a psychology of group behavior as opposed to the individual. 03:35.900 --> 03:41.060 My minor was deviancy, which has served me well in this environment. 03:42.100 --> 03:46.360 My grad work and degrees are in security management and cyber security. 03:46.360 --> 03:53.200 So I kind of came into the security arena from the cyber area kind of late, but it can be done. 03:53.720 --> 04:01.680 The agenda for this talk is going to kind of cover some conceptual groundwork so you can kind of understand some of the research when I share it. 04:02.780 --> 04:05.360 I still can't feel the ends of my fingers either. 04:06.080 --> 04:07.640 It's neuropathy. 04:09.380 --> 04:17.300 So last time I spoke at DEF CON I was actually fortunate enough to have one of the researchers I cited that attended my talk. 04:17.300 --> 04:30.580 So if any of the researchers I mention in my talk actually happen to be sitting here, like jump up and wave your arms so we can say hi and maybe have you come up and maybe tell us about your research better than I can maybe. 04:33.000 --> 04:35.240 So cognitive memory. 04:35.300 --> 04:44.980 This is cognition is the mental action or process of acquiring knowledge and understanding through thought, experience, or your senses or some combination of them. 04:44.980 --> 04:52.200 It's knowledge, attention, memory, judgment, evaluation, reasoning, problem solving, all of that. 04:52.200 --> 04:56.200 And it can be conscious or sub slash unconscious. 04:58.500 --> 05:06.180 It can be intuitive, which is the ability to acquire knowledge without understanding. 05:06.180 --> 05:13.980 So if you think of like instinct, or it can be conceptual, so based on ideas or concepts, like if you're in a classroom learning something. 05:16.850 --> 05:21.830 Consciousness can be defined from two different ways, biologically or philosophically. 05:21.830 --> 05:32.750 So your consciousness from a biological perspective refers to the idea of being like awake and aware of your surroundings and experiences in the people and things in your environment. 05:32.750 --> 05:37.590 And philosophically it can refer more to like having a soul or a sense of self. 05:37.590 --> 05:41.830 We're going to be focusing on the biologic consciousness here. 05:44.210 --> 05:51.830 Unconsciousness is when your ability to maintain an awareness of your environment or surrounding like stimulus is lost. 05:51.970 --> 05:57.330 And there's either a complete or near complete lack of responsiveness to your environment or any stimulus. 05:57.630 --> 06:03.370 There's a medical concept of being unconscious and a legal concept of being unconscious. 06:05.070 --> 06:18.710 So medically you can be unconscious kind of like from like a brain injury or perhaps like a drug induced unconsciousness that they'll do sometimes. 06:19.830 --> 06:32.510 But legally you can also be unconscious maybe if you're impaired from drugs or hypnosis or has anyone in here been like so tired that they just can't even anymore. 06:32.870 --> 06:39.710 You're awake and you're standing up and you're like able to function but your mind, you're just done. 06:39.890 --> 06:44.270 So that can kind of go into the area of like legally unconscious in a way. 06:44.470 --> 06:47.090 But I'm not a lawyer so don't try to use that in court. 06:49.490 --> 06:56.250 So Sigmund Freud in 1893 was the first to use the term subconscious. 06:56.890 --> 07:09.190 And what I thought was really interesting was when I was trying to figure out like where they really drew a line between subconscious and unconscious it turns out that Sigmund Freud actually used the terms interchangeably because in his native German it was kind of almost the same word. 07:09.450 --> 07:17.470 And now the argument seems to be more of a kind of a semantic grammatical thing than a definitive thing. 07:17.970 --> 07:30.590 In general unconsciousness typically tends to refer to a state of awareness from a medical perspective and subconscious tends to refer to an aspect of your psyche when discussing more of like a psychoanalytical environment. 07:31.250 --> 07:36.150 But if there's any shrinks in the audience who want to argue about it we can do that later. 07:36.350 --> 07:45.350 The best I can tell is it's more of a grammatical issue than a definitive one, but I am going to differentiate in them in this talk. 07:51.110 --> 07:57.150 So for now just think of subconscious as the part of your consciousness that is not currently in your focal awareness. 07:57.650 --> 08:00.710 And there was a psychologist named Edwin Locke who put it really well. 08:00.710 --> 08:04.790 I think he called it the alternative storehouse of knowledge and prior experience. 08:04.790 --> 08:07.650 And there's two main types of long-term human memory. 08:07.650 --> 08:11.030 We have explicit and implicit memory. 08:14.570 --> 08:18.310 That was my obligatory cat slide for DEF CON. 08:20.050 --> 08:23.050 Explicit memory is also known as declarative memory. 08:23.790 --> 08:29.070 It's conscious and there's two kinds, episodic and semantic. 08:30.950 --> 08:39.590 So episodic is more storing a personal experience like a kiss that really meant a lot to you or that you remember distinctly. 08:39.590 --> 08:45.030 And then semantic would be more like data about the kiss or a kiss. 08:49.280 --> 08:54.300 Implicit memory, is anyone here ride bikes or can you ride a bike? 08:54.300 --> 08:56.440 So that's kind of a good example. 08:56.440 --> 09:07.260 I do triathlons and we train constantly to get things into our implicit memory so that when you're in the middle of a race, it's just your instinct, it kind of takes over. 09:07.940 --> 09:14.380 So it's basically acquired and used unconsciously and it can affect your thoughts and behaviors. 09:14.680 --> 09:21.080 And this is kind of where when we get to talking about implanting, this is where they're putting the password. 09:21.300 --> 09:28.620 One of the most common forms is procedural which helps people performing certain tasks without awareness of actually performing it. 09:28.620 --> 09:35.740 People use explicit memory throughout the day like remembering an appointment or recalling an event from years ago. 09:37.180 --> 09:42.020 And implicit is more like an unintentional subconscious form. 09:42.020 --> 09:47.360 So if you remember a specific driving lesson you had, that's an example of explicit memory. 09:47.360 --> 09:53.760 But if your driving skill improves as a result of that lesson, that is more the implicit memory. 09:55.400 --> 09:58.440 Okay, memory is a tool versus memory is an object. 10:00.540 --> 10:03.000 They've put forth that you can use it kind of both ways. 10:03.000 --> 10:15.100 So memory is treated as an object when you're recalling or recognizing like an actual memory but then if you're talking about using it to serve as an authenticator this is more like where you would use it as a tool. 10:15.120 --> 10:16.760 And so why is this important? 10:16.760 --> 10:25.140 Because they're looking at this research as being considered potentially a subclass of behavioral biometric measurement. 10:26.640 --> 10:30.740 So this is where we're going to start to connect with the idea of implanting passwords as an option. 10:30.740 --> 10:33.860 So we're going to talk about encoding, storage, and retrieval. 10:35.300 --> 10:39.400 So with encoding, this is processing information into the memory. 10:39.520 --> 10:42.580 And there's several different ways of encoding information. 10:42.580 --> 10:45.800 There's structural encoding, which is how something looks. 10:45.920 --> 10:48.180 And an example would be if you had a word. 10:48.180 --> 10:48.860 Is it long? 10:48.860 --> 10:49.700 Is it short? 10:49.700 --> 10:51.700 Is it all uppercase or lowercases? 10:51.700 --> 10:52.620 Is it handwritten? 10:52.620 --> 10:53.720 Is it typed? 10:53.720 --> 10:56.580 Then mnemonic encoding is how something sounds. 10:56.580 --> 10:58.700 So like how does a certain word sound? 10:58.700 --> 11:01.600 And then semantic encoding focuses more on the meaning. 11:01.600 --> 11:05.760 And it requires a deeper level of processing than structural or mnemonic. 11:05.880 --> 11:09.780 And it usually results in a better memory because you're kind of creating an association. 11:11.320 --> 11:18.400 Storage is after the information enters your brain, it has to be stored or maintained or forgotten. 11:21.380 --> 11:26.020 So there's a three stage model that was proposed by Richard Atkinson and Richard Shiffrin. 11:26.020 --> 11:28.100 It's often used to describe this process. 11:28.100 --> 11:31.820 This is my attempt to make a representation of it. 11:32.240 --> 11:37.780 So essentially you have sensory memory, short term memory, and long term memory. 11:37.860 --> 11:42.040 Sensory memory stores the incoming sensory information in detail, but only for an instant. 11:42.040 --> 11:46.520 The capacity is very large but the information in it is unprocessed. 11:46.520 --> 11:49.040 Visual sensual memory is iconic memory. 11:49.040 --> 11:52.260 And auditory sensory memory is called echoic memory. 11:52.260 --> 12:02.360 So then you get to short term memory and some of the information in sensory memory can transfer into short term memory and that can hold information for about 20 seconds. 12:02.600 --> 12:07.080 And rehearsing is a way that you can kind of keep information in your short term memory longer. 12:07.320 --> 12:20.600 So an example is like if someone, like if you're parking your car and you're trying to remember like where did you park your car and you're walking to whatever and you're like P2, P2, P2, it's kind of like a way to kind of keep it in your mind and get it in there a little better. 12:20.600 --> 12:26.860 Short term memory has a limited capacity and it can store about seven pieces of information, give or take. 12:26.920 --> 12:34.420 And these pieces of information can be small, such as like individual numbers or letters, or larger like familiar strings of numbers or words. 12:34.420 --> 12:43.100 So like if you're trying to remember the word cat, you're not going to remember C-A-T, you're going to remember the word cat with the visual. 12:45.740 --> 12:50.780 So information can be kept in your working memory while you process or examine it. 12:50.780 --> 12:56.220 And then once you're done with it, it either is pretty much forgotten or it moves into your long term memory. 12:56.460 --> 13:04.060 Long term memory has an almost infinite capacity and the information usually stays there for the duration of a person's life. 13:04.060 --> 13:16.860 However, the big issue is it's there, but you're not always able to retrieve it, which is where the chemo kind of affected me was the data was in there, I was just not able to pull it out and that's what I was struggling with. 13:17.800 --> 13:21.800 So with retrieval, that's the process of getting the information out of your memory. 13:21.800 --> 13:27.140 And they have these retrieval cues and those are stimuli that can kind of help you remember. 13:27.620 --> 13:30.900 And they include associations, context, and mood. 13:33.260 --> 13:40.400 So context is you can try to remember an event by putting yourself in the same context you were when it happened. 13:40.480 --> 13:47.380 Such as if someone lost a paddle from last night and they're trying to remember where it is. 13:47.780 --> 13:49.600 Sorry, that was for my boss. 13:50.220 --> 13:57.620 They could kind of go back to where they remember they had it last and walk through if they can remember where they went next and see if they can find it. 13:57.620 --> 14:00.280 Or you can do the same with your car keys if you've ever lost them. 14:01.800 --> 14:05.500 Associations, this is our equal opportunity, gratuitous, sexy photos. 14:05.500 --> 14:08.460 I hope I hit most everyone in the audience. 14:09.900 --> 14:14.140 If not, I'm so sorry, but I only had so many slides and so much time. 14:14.560 --> 14:18.020 But the brain stores information as networks of associated concepts. 14:18.020 --> 14:23.760 So recalling a particular word can be easy if another related word is recalled first. 14:23.760 --> 14:40.700 So here's an example if I show you guys like these sunbathers on the beach and then I ask you to spell the word bear, you may be more likely to spell B-A-R-E instead of B-E-A-R because the picture kind of primed you and associated you to that particular spelling. 14:40.700 --> 14:42.060 And then there's mood. 14:42.060 --> 14:51.200 So if you're in the same mood you were during a particular event, you can have maybe an easier time recalling the event, like kind of a nostalgia type thing if you think about it. 14:52.940 --> 14:54.380 Here's our other cat. 14:54.960 --> 15:00.000 They told me I had to put so many cats in and so many sexy photos, so I tried to make sure I got them all. 15:00.940 --> 15:01.860 Next slide . 15:03.180 --> 15:09.440 Okay, the human brain has about a billion neurons in it and each neuron forms about a thousand connections. 15:10.240 --> 15:14.040 And this is about somewhere around a trillion connections I think. 15:14.060 --> 15:19.440 The challenge is if each neuron could only store a single memory, running out of space would be a huge problem. 15:19.520 --> 15:36.680 So you might only have maybe a few gigabytes of storage space, like about the same as an iPod or a USB flash drive, but because the neurons combine so that each one helps with many memories at a time, it exponentially increases your brain's memory storage capacity to something closer to about 2.5 petabytes. 15:36.680 --> 15:49.560 And the example, I think it was something like 300 million hours of television shows is about the capacity to store in there because of the way the neurons can connect. 15:52.640 --> 15:54.100 Time check? 15:54.280 --> 15:58.500 Alright, there are some limitations to memory. 15:58.640 --> 16:02.560 I think everyone in here has seen that gorilla basketball video. 16:02.900 --> 16:06.220 So that's like inattentional blindness or the illusion of attention. 16:06.220 --> 16:10.200 You focus so much on one thing, you completely miss other stuff going on. 16:11.200 --> 16:12.320 Sorry. 16:12.480 --> 16:14.100 There's false memories. 16:14.100 --> 16:19.740 There's the illusion of confidence, which interestingly enough, apparently that's the opposite of imposter syndrome. 16:19.740 --> 16:20.920 They have one. 16:22.240 --> 16:23.500 The illusion of cause. 16:23.500 --> 16:29.120 There's a tendency to make casual connections between related facts that maybe are not accurate. 16:33.410 --> 16:36.190 This is where I want to get into the research. 16:37.310 --> 16:41.770 One word, concept, vocabulary thing is called brain computer interface. 16:42.010 --> 16:48.810 So the initial motivation behind brain computer interfaces was to develop the communication devices for the severely disabled. 16:48.870 --> 16:57.230 Seeing as that I only have a limited time to speak, I won't go into the deep dive about how an individual can train their mu and beta brain waves to control a cursor. 16:57.230 --> 17:01.450 And there's some fascinating stuff around visual evoked potentials. 17:01.550 --> 17:06.650 But there's a plethora of research out there if you're super interested in that level of granularity. 17:07.070 --> 17:10.390 But I did want to point out there is some research by Dr. 17:10.390 --> 17:11.050 J.R. 17:11.050 --> 17:14.790 Wolpow and his research team as a starting point. 17:14.790 --> 17:15.910 And then Dr. 17:15.910 --> 17:19.050 Niels Birbaumer with the thought translation device. 17:19.050 --> 17:22.470 He's with the University of Tübingen in Germany. 17:22.470 --> 17:29.710 And he has created this device that allows users to compose phrases and sentences electronically just by thinking them. 17:29.710 --> 17:31.090 So he's neat. 17:31.090 --> 17:35.430 And you may also want to look at a paper out of Dartmouth College about the Neurophone. 17:35.490 --> 17:39.750 It's a brain mobile phone interface using a wireless EEG headset. 17:40.050 --> 17:46.150 And in their paper his team shares the details of a brain controlled address book dialing app they created. 17:46.310 --> 17:49.490 So the point is this is a super huge area of research. 17:49.490 --> 17:54.090 But I haven't heard a lot of it on kind of our side of the house as far as the security of these things. 17:54.170 --> 17:59.830 But I did want to share the four key pieces of research that I found to be the most interesting and with the most potential. 18:05.570 --> 18:07.050 First there's this... 18:07.050 --> 18:08.230 wait, go back. 18:11.160 --> 18:25.020 So first I'm going to murder this man's name, so I apologize ahead of time, but Hristo Bojanov at Stanford was working with some cognitive scientists at Northwestern University and they designed a game that looks similar to Guitar Hero. 18:25.260 --> 18:29.040 And this is called CISL, Serial Interception Sequence Learning. 18:29.460 --> 18:36.060 And it's an authentication procedure that they created this testing experiment around. 18:36.060 --> 18:39.960 And they used Mechanical Turk through Amazon to do their experiments. 18:40.560 --> 18:49.160 So I'm not sure how well that looks as far as like how you're able to look at your subject pool from an experimental perspective. 18:52.010 --> 18:52.990 I'm trying. 18:52.990 --> 18:54.570 I'm like all up on it. 18:54.710 --> 19:00.030 I do want to walk you through how it works, but I want to make sure I get it right, so I want to read it. 19:00.030 --> 19:06.350 The process of learning the password involves the use of a specially crafted computer game that resembles Guitar Hero. 19:06.350 --> 19:10.230 There are six buttons S, D, F, J, K, and L. 19:10.230 --> 19:15.770 And the user has to hit the corresponding key or note when the circle reaches the bottom fret. 19:15.770 --> 19:22.510 So during a typical training session of around 45 minutes, a user will make about 4,000 keystrokes. 19:22.510 --> 19:28.890 And around 80% of these keystrokes are being used to subconsciously teach you a 30 character password. 19:34.430 --> 19:42.870 Before running, the game creates a random sequence of 30 letters chosen from the S, D, F, J, K, and L with no repeating characters. 19:42.870 --> 19:45.930 This equates to around 38 bits of entropy. 19:47.010 --> 19:55.490 And the 30 character sequence is played back to the user three times in a row and then padded out with 18 random characters for a total of 108 items. 19:55.650 --> 20:01.770 The sequence is repeated five times, and then there's a short pause, and the entire process is repeated six more times. 20:01.770 --> 20:09.210 And by this point, the experimental results suggest that a 30 letter password is firmly implanted in your subconscious brain. 20:09.230 --> 20:18.050 The authentication requires that you play a round of the game, but this time your 30 letter sequence is interspersed with other random 30 letter sequences. 20:18.050 --> 20:22.090 To pass the authentication, you have to reliably perform your sequence. 20:22.290 --> 20:26.850 The research shows that even after two weeks, you're able to recall the sequence. 20:28.610 --> 20:30.990 The next one is past thoughts. 20:30.990 --> 20:33.970 So this is from Berkeley, 2013. 20:34.310 --> 20:37.050 This technique combines three factors. 20:37.050 --> 20:45.370 Something you know, which is a thought, something you are, your brain patterns, and then something you have, which is the EEG sensor for measuring the brain waves. 20:45.370 --> 20:49.890 To authenticate with a past thought, you think your secret key while using the sensor. 20:50.270 --> 21:01.250 The key can be just about anything, a song, a phrase, or a mental image, and the thought itself is never transmitted, just a mathematical representation of the electrical signals your brain makes while you think it. 21:04.140 --> 21:13.040 Now, if someone else were to figure out what you were thinking, they still couldn't impersonate your past thought in theory because every person thinks the same thing differently. 21:13.420 --> 21:22.620 So, you know, we could all think about the same song, but we're not all going to think about it exactly the same way as far as being registered electronically. 21:23.900 --> 21:25.140 Time check. 21:25.240 --> 21:27.080 Okay, so this is how they did this one. 21:27.080 --> 21:31.580 The following tasks were repeated five times in each session for each subject. 21:31.580 --> 21:36.920 They had a breathing task, so they had to close their eyes and focus on their breathing for 10 seconds. 21:36.920 --> 21:46.980 They had a simulated finger movement, so subjects imagined in their mind that they were moving their right index finger up and down in sync with their breathing without actually moving their finger. 21:47.060 --> 21:55.520 There was a sports task where they selected a repetitive motion from a sport of their choosing, and they imagined moving their body muscles to perform the motion. 21:55.740 --> 22:12.680 Then there was a song passage recitation task, an eye audio tone task, an object counting task, and then at the very end they had a past thought which they were asked to choose their own past thought like a password, but instead of choosing a sequence of letters or numbers, 22:12.680 --> 22:20.560 they thought of a thought, like a vision of their wedding, or their child being born, or the first time they got drunk, or what have you. 22:20.560 --> 22:26.440 And that they had to think about that for 10 seconds, and then everything together became their past thought. 22:30.890 --> 22:35.990 So this was some other interesting research that was done that kind of fed into the next one. 22:35.990 --> 22:40.410 It was on the feasibility of side-channel attacks with brainwave computer interfaces. 22:41.230 --> 22:48.390 I do have these papers cited at the end of my slide deck, so if you look them up on the torrent, they'll be there. 22:48.410 --> 22:58.890 But it studied the possibility of side-channel attacks using commercial EEG types of headsets to reveal users' personal information like their banks, ATMs, or PIN digits. 22:58.890 --> 23:06.970 Their approach was similar to a guilty knowledge test where items familiar to a user are assumed to evoke different responses as compared to items that are unfamiliar. 23:07.230 --> 23:20.170 So for example, when a person was shown images of many banks, the brain response to the image of their bank had more of an interaction or evoked a higher potential with the waves. 23:20.170 --> 23:27.270 The problem with their attack setup, it was intrusive and it could be easily detected by the user, but that brought us to PEEP. 23:28.230 --> 23:37.450 So PEEP built upon their research, and what they tried to do was create an actual keylogger-slash-malware. 23:37.490 --> 23:43.990 And this actually was on phys.org in June 29th, and I'll read from the article. 23:43.990 --> 23:44.730 It's a quote. 23:44.730 --> 24:00.150 Researchers at the University of Alabama at Birmingham suggested that brainwave sensing headsets, also known as EEG, need better security after a study reveals hackers could guess a user's passwords by monitoring their brainwaves. 24:00.170 --> 24:15.710 So in contrast to the research I mentioned on the previous slide, the folks at the University of Alabama wanted to test out a more surreptitious, less intrusive approach that only required passive monitoring of brain signals as the user's type pins or passwords. 24:15.730 --> 24:23.050 And so they called theirs PEEP, which is passively eavesdropping private input via brainwave signals. 24:23.050 --> 24:28.170 And this was University of Alabama and I think one gentleman from California Riverside. 24:29.890 --> 24:40.470 Now, they extensively referenced the research of the previous group with the side channel attacks, and they named their keylogger PEEP. 24:40.470 --> 24:51.150 And so according to their paper, as the use of these devices, which they're referring to the EEG gaming and entertainment devices, headsets, for any of you who game, it becomes mainstream. 24:51.150 --> 24:57.990 A user may enter passwords or private credentials to their computers or their mobile phones while they're wearing these devices. 24:58.190 --> 25:08.990 And so they were studying the potential of introducing a malicious app to capture those EEG signals and then process the signals to infer the sensitive keystrokes. 25:09.310 --> 25:18.090 So the gentleman and his team used one regular store-bought EEG headset that anyone could buy at or what have you. 25:18.090 --> 25:21.970 And then they also used a clinical grade headset in their experiment. 25:21.970 --> 25:28.230 And they were able to demonstrate how easy a malicious software program could passively eavesdrop on your brainwaves. 25:28.250 --> 25:34.290 So while typing your inputs, it could sense all of this. 25:34.330 --> 25:50.010 And I think he saw a quote from the article, in a real-world attack, a hacker could facilitate the training step required for the malicious program to be the most accurate by requesting that the user enter a predefined set of numbers in order to restart the game after pausing it to take a break, 25:50.010 --> 25:54.430 similar to the way a CAPTCHA is used to verify certain users are logging in. 25:54.430 --> 26:07.010 The research showed that after a user entered 200 characters, algorithms within the malicious software program could make educated guesses about new characters the user entered by monitoring the EEG data recorded. 26:07.070 --> 26:23.250 The algorithm they created was able to shorten the odds of a hacker guessing a four-digit numerical pin from 1 in 10,000 to 1 in 20, and increase the chance of guessing a six-letter password from about 1 in 500,000 to roughly 1 in 500. 26:31.760 --> 26:36.400 So... security posture versus a rubber hose type of cryptoanalysis. 26:36.400 --> 26:46.680 The challenge in testing their hypothesis is that as far as I know, especially at Stanford, there's no studies that actually allow you to beat people during an experiment. 26:47.700 --> 26:51.460 So I think in a way they were kind of sexifying their paper title. 26:51.460 --> 26:53.140 You know, no shade. 26:53.200 --> 27:12.720 But after a long discussion with a psychologist friend, my current opinion with CICEL, which is the guitar hero in past thoughts, is there seems to be some dependence on the consistency of the entry of the authentication, and by introducing an actual rubber hose type attack or some other similarly traumatic level of extraction, 27:12.720 --> 27:15.480 this could affect the brainwaves themselves. 27:15.480 --> 27:21.580 So the ability to perform the action or the entry in a manner consistent with the password was set up. 27:21.600 --> 27:28.000 It could affect that, thus rendering it, you know, even if you have it, it's not going to work because it's not matching the brainwaves. 27:28.000 --> 27:37.460 Because if you're relaxed when you're going through the implantation, but you're being beaten with a rubber hose, even if they get the string, it's going to be different. 27:38.420 --> 27:46.980 So starting with the CICEL or the guitar hero, they were able to test retrieval, but not under stress or trauma. 27:47.040 --> 27:56.260 And they were able to test basic coercion, trying to fool the system, and that went pretty well. 27:56.260 --> 28:10.180 The potential attacks against that one involved the use of remote authentication approach, whether or not the attacker is allowed multiple extraction attempts, if there's performance gaps, eavesdropping, none of this stuff's been tested, just the retrieval has been tested. 28:12.100 --> 28:21.460 With past thoughts, a hacker might be able to defeat the system by using a phishing scheme that would trick you into thinking your past thought, capturing the output, and maybe later playing it back. 28:22.460 --> 28:28.980 And it was pointed out by the research team that the approach being used by them and the side channel attacks 28:32.220 --> 28:34.000 my brain just went dead. 28:35.600 --> 28:51.860 The stuff is generated for implantation with a random generator so you could probably go after it from the source by going after the random generator that issues it versus the actual person who has it, if that makes sense. 28:56.800 --> 29:03.660 As to CICEL and past thoughts, they're still in a mostly theoretical stage as far as research and experimentation goes. 29:04.120 --> 29:19.780 I didn't really see anyone addressing how memory could be affected by such things as drug use or injury or even degradation, such as if you have an employee that's going through chemo and suddenly their brain is affected, would they even be able to use any of this? 29:19.780 --> 29:22.720 Would that affect the authentication pattern? 29:24.180 --> 29:30.980 I don't really see this being viable for use at large right now until some of those questions are answered. 29:34.280 --> 29:52.520 We're all here at DEF CON, so what happens if you have the password implanted while you're sober at work but then you've had a couple drinks and you need to finish a proposal, are you going to be able to authenticate or will being drunk or kind of drunk or even just slightly impaired affect that ability? 29:52.520 --> 29:55.540 And that was another thing I didn't see addressed. 29:56.300 --> 29:58.180 Cost was another big thing. 29:58.180 --> 30:03.440 It's all well and good to propose this, but what's the exact cost associated with implementing something like this? 30:03.440 --> 30:06.820 And would it be realistic to deploy? 30:07.020 --> 30:12.280 So with SISL, the training or encoding time was noted to be 45 minutes. 30:12.400 --> 30:16.480 And with PastThoughts, it was two 40-50 minute sessions. 30:16.480 --> 30:29.760 And so if you have a small organization, 5-10 people, that might be okay, but I'm trying to picture Lockheed Martin or something trying to do this with thousands of people trying to put each one of them through that. 30:30.700 --> 30:39.040 With SISL, there are certain people this probably would work best with, but factors such as mental capacity or psychological issues. 30:39.040 --> 30:45.860 My sister-in-law works with special needs adults who do stuff at the airport and have to go through security checkpoints. 30:45.860 --> 30:53.540 So especially with the Guitar Hero type of thing, would there be certain people that just wouldn't be able to authenticate this way? 30:53.540 --> 30:57.540 Just legitimately, from a handicap perspective, they can't do it. 30:57.540 --> 31:06.640 Even some of our wounded warriors who don't have hands to do this intricate type of authentication. 31:07.080 --> 31:12.780 And then things like Parkinson's seizures, what if the individual is blind and can't even see? 31:12.780 --> 31:18.660 I didn't really see any of this addressed as far as using it in a real world on a large scale. 31:19.720 --> 31:25.200 All in all, I think it's fascinating with potential, but the research is still in a pretty early stage. 31:25.920 --> 31:38.920 The sample groups also, if anyone here grad school, scientific research, test groups, so the CISIL-CISE experiment number one was done with 35 participants. 31:39.520 --> 31:52.780 Number two had two groups, 32 and 80 participants, for a total of 147, but they didn't clarify if any of those were duplicates from the first to second experiment, so it actually might have been a smaller group number. 31:54.020 --> 32:01.000 Based on my own experience, I'm not sure 147 represents a solid sample, other than whether or not it warrants further study. 32:01.000 --> 32:05.360 I do think it warrants further study, but so far it's still very theoretical. 32:05.360 --> 32:12.120 The past thoughts material I read was based on research on a group of a total of 15 subjects. 32:12.460 --> 32:20.620 The side channel attack research had 28 subjects, and the PEEP research had a whopping 12 subjects. 32:20.640 --> 32:36.540 So again, this is still really kind of in very theoretical stage, and a pool of 12 subjects to me is not a huge sample size from a research perspective, except for maybe to do further research. 32:36.840 --> 32:50.000 My thoughts around hackability, CISIL refers to the rubber hose, I just really don't see that, I don't see how they really addressed it, I think they just used the word because it sounded cool. 32:51.420 --> 32:58.120 The theory that the knowledge is not consciously accessible to the individual, I'm still not sure on that. 32:58.580 --> 33:04.880 I have a psychologist friend, and he's in agreement with me, like, if you can put it in, you can take it out. 33:05.560 --> 33:07.860 And there's ways to do that. 33:09.660 --> 33:17.100 For CISIL, a good potential attack factor might be again, like I said, the random number generator, or the random password generator. 33:17.160 --> 33:30.100 And in their paper, the past thought team pointed out they were not vulnerable to shoulder surfing because their system was invisible, but they felt they were very vulnerable to both social engineering and dictionary attacks as their system stood. 33:30.100 --> 33:41.340 However, it was their hope that with advances in signal recording and processing technology, it would allow for a much more detailed capture of the thought itself, and that would protect better against some of the dictionary attacks. 33:41.340 --> 33:52.480 And they also felt they were fairly vulnerable to phishing attacks, where if you could get someone to click on something and record their thoughts while they were clicking, they were kind of vulnerable from that perspective. 33:53.500 --> 34:04.380 CISIL's not designed to prevent eavesdropping or shoulder surfing attacks, so I imagine a good video recording of them performing the sequence could allow an attacker to replicate it. 34:04.380 --> 34:11.300 And considering how many security video cameras are insecure, this is definitely a distinct possibility. 34:11.300 --> 34:25.420 And I believe they did say that in some of the experiments, the error ratio was just enough that if someone knew that person's sequence, there were times they were able to impersonate it. 34:27.340 --> 34:33.820 I talked to my psychologist friend about using hypnosis to potentially extract it. 34:34.380 --> 34:39.100 That I've done a little more research into, and I'm not sure that's really a viable vector. 34:39.480 --> 34:44.740 But he and I are actually still discussing that at length, so maybe I'll have more on that in the future. 34:44.740 --> 34:47.680 Another thing, CISIL's a flash application. 34:48.500 --> 34:51.140 So I'll just put that right there. 34:53.820 --> 34:56.720 That was my first big like, okay. 34:57.460 --> 35:14.100 And CISIL's authentication process is potentially vulnerable to attack if even an untrained person is able to mimic or degrade their performance to match the person they've watched authenticate. 35:16.860 --> 35:23.620 And then the authentication based on keystroke dynamics is similar to authentication based on the past thoughts. 35:24.880 --> 35:30.620 So it looks at their typing rhythm and what they're thinking at the same time. 35:32.260 --> 35:36.300 So I think they just still need to do more research. 35:36.480 --> 35:52.900 So in closing, I think much of this is still in the experimental stage, and it's going to be really interesting to see if anything actually comes of it, especially considering trying to deploy it across a large environment or organization, or a very varied population, 35:52.900 --> 35:55.340 like a bigger sample size than 12. 35:57.040 --> 35:58.260 Check my time. 35:59.840 --> 36:02.340 Some of my research, I have the papers. 36:02.340 --> 36:05.700 There are links to them, but you don't have to click them. 36:06.040 --> 36:09.260 You can just Google the name of the paper in Google Scholar. 36:09.260 --> 36:10.680 It'll come right up. 36:12.440 --> 36:22.520 And then the last thing I wanted to leave you with is it was kind of interesting, about halfway through my research someone mentioned to me, oh my god, have you read this? 36:22.520 --> 36:27.180 It's a book called Hard Boiled Wonderland and the End of the World. 36:27.180 --> 36:31.220 And it was written by Haruki Murakami. 36:31.300 --> 36:34.900 And it's actually from 1985. 36:36.640 --> 36:43.980 And what I thought was really interesting is I'm not going to spoil it if you want to read it, but it's a parallel narrative type setup. 36:44.140 --> 36:47.520 One of the narrators is called a calcutech. 36:47.520 --> 36:55.220 And it's a human data processor encryption system who's been trained to use their subconscious as an encryption key. 36:55.780 --> 37:00.940 And the other narrator is a newcomer to a strange isolated town. 37:00.940 --> 37:02.920 And I'll leave it there so I don't spoil it. 37:02.920 --> 37:15.980 But if you find this interesting, I actually thought it was pretty fascinating that back in 1985, even fantasy authors were thinking about the idea of using the mind to authenticate and for encryption. 37:16.460 --> 37:18.920 So that's all I have. 37:19.640 --> 37:22.720 I can do questions now if anyone has them.