1
00:00:00,000 --> 00:00:08,140
Years ago, I was sitting in the Paris hotel waiting for DEFCON to start and my

2
00:00:08,140 --> 00:00:16,760
phone rang and it was my doctor telling me that the test came back from my

3
00:00:16,760 --> 00:00:21,300
biopsy that I had had literally the day before I flew to DEFCON and had breast

4
00:00:21,300 --> 00:00:30,760
cancer. So I share that because it's actually what provoked me to do this

5
00:00:30,760 --> 00:00:42,380
research in a very strange roundabout way. So in addition to having a double

6
00:00:42,380 --> 00:00:46,200
mastectomy, full reconstruction and everything, I had to go through pretty

7
00:00:46,940 --> 00:00:48,340
aggressive chemotherapy.

8
00:00:51,300 --> 00:00:56,640
The regimen that I used, if people are familiar with it, is the ACT. So it's the

9
00:00:57,420 --> 00:01:02,140
Adriamycin, the Cytoxin and the Taxol. So I know, I think most people who have

10
00:01:02,140 --> 00:01:04,500
never been through chemo or know someone who's been through it pretty much like,

11
00:01:04,620 --> 00:01:09,780
oh you lose your hair, you know. There's a lot of additional side effects to chemo

12
00:01:09,780 --> 00:01:16,160
that I don't think they really advertise them and I was not prepared for. One of

13
00:01:16,160 --> 00:01:20,240
them is something called chemo brain. Has anyone ever heard of this?

14
00:01:20,420 --> 00:01:20,700
No.

15
00:01:20,780 --> 00:01:20,900
So chemo brain, chemo brain, chemo brain, chemo brain, chemo brain, chemo brain, chemo brain, chemo brain, chemo brain, chemo brain.

16
00:01:20,900 --> 00:01:28,560
Okay, some of you have. So what happens is the, most specifically the Adriamycin, but

17
00:01:28,560 --> 00:01:34,060
pretty much all these drugs are toxins and poisons. And I think the best way I

18
00:01:34,060 --> 00:01:36,560
heard it described one time is they're trying to kill the cancer before they

19
00:01:36,560 --> 00:01:44,460
kill you, basically. So this Adriamycin, or also known as doxorubicin, it kind of

20
00:01:44,460 --> 00:01:50,320
messes up your mitochondria, which changes their ability to do things and

21
00:01:50,320 --> 00:01:56,300
their energy. And essentially chemo brain is forgetfulness, memory lapses,

22
00:01:56,300 --> 00:02:20,200
difficulties concentrating or focusing on tasks, and struggling to do more than one task at a time. So as a hacker, I've never been, like when I lost the hair and the eyebrows and eyelashes and all that, I've never been the pretty girl.

23
00:02:20,200 --> 00:02:26,080
So it was like, alright, whatever. But when I started to lose my brain, that was scary. It was very scary.

24
00:02:28,100 --> 00:02:32,100
And when I came out of it, I kind of thought it would just all like turn back on. And

25
00:02:32,100 --> 00:02:36,920
it didn't. And that was a little distressing to say the least,

26
00:02:37,040 --> 00:02:41,060
especially if you're someone who uses their brain every day as their work. So

27
00:02:41,060 --> 00:02:46,840
it kind of pushed me into this research on how do I heal my brain? How do I fix

28
00:02:46,840 --> 00:02:50,180
what the chemo did to me? And as I was

29
00:02:50,180 --> 00:02:56,940
doing that research I stumbled into this entire concept of using the memory as an

30
00:02:56,940 --> 00:03:01,700
authenticator and I thought oh my god that is fascinating how does that work

31
00:03:02,440 --> 00:03:08,600
and that's how we got here today so a not so happy start to the research but

32
00:03:08,600 --> 00:03:14,280
found this fascinating information started doing more study into it you

33
00:03:14,280 --> 00:03:17,860
know are there ways that I can improve my own brain health but then I thought

34
00:03:17,860 --> 00:03:21,520
this is really neat and I wanted to really kind of dig into it to see where

35
00:03:21,520 --> 00:03:25,960
they were with it is it really something viable that we could use soon in the

36
00:03:25,960 --> 00:03:29,960
future you know and just kind of like understand how does it work you know

37
00:03:29,960 --> 00:03:34,240
what exactly how does this work because you can say implant a password into your

38
00:03:34,240 --> 00:03:38,880
brain well how do you do that right so that's what I'd like to talk about today

39
00:03:39,400 --> 00:03:42,700
but so a little bit about me I'm a security engineer and researcher with

40
00:03:42,700 --> 00:03:47,240
Digital Cloak and my background undergrad work is in

41
00:03:47,860 --> 00:03:53,500
psychology so that's the psychology of groups as opposed to the individual but

42
00:03:53,500 --> 00:04:02,820
they do do a lot of psychology in that excuse me my grad work and graduate

43
00:04:02,820 --> 00:04:08,540
degrees are in cybersecurity and security management what I'd like to do

44
00:04:08,540 --> 00:04:12,260
I don't know if anyone seen me talk on quantum computing or not but what I like

45
00:04:12,260 --> 00:04:15,960
to do is kind of give you kind of a groundwork with some kind of shared

46
00:04:15,960 --> 00:04:17,700
vocabulary kind of

47
00:04:17,860 --> 00:04:21,400
so we can all be on the same page before I get to the research and then the

48
00:04:21,400 --> 00:04:25,480
research will make a little more sense because we kind of all know the basics

49
00:04:26,660 --> 00:04:37,440
so so cognitive memory cognitive memory is the mental action or process of

50
00:04:37,440 --> 00:04:40,340
acquiring knowledge or understanding through your thought experience or your

51
00:04:40,340 --> 00:04:45,180
senses or some combination of all of them it can be subconscious slash

52
00:04:45,180 --> 00:04:47,060
unconscious which I'll go into that in a second

53
00:04:47,860 --> 00:04:54,900
do we have any psychologists in the room okay I'm a little less nervous now it

54
00:04:55,220 --> 00:04:58,940
can be conscious or subconscious slash unconscious or it can be intuitive

55
00:04:58,940 --> 00:05:02,880
which is kind of like if you think about instinct acquiring knowledge

56
00:05:02,880 --> 00:05:07,100
without really understanding how your knowledge was acquired or it can be

57
00:05:07,100 --> 00:05:12,460
conceptual based on ideas and concepts like sitting in a class and learning

58
00:05:15,200 --> 00:05:17,760
consciousness can be defined by a

59
00:05:17,860 --> 00:05:23,300
biologically, or it can be kind of defined philosophically. Biologically, it refers to the

60
00:05:23,300 --> 00:05:28,660
idea of being awake, aware of your surroundings and experiences. And philosophically, it kind of

61
00:05:28,660 --> 00:05:34,220
refers to having a sense of the self or possessing a soul. We will obviously be focusing on the

62
00:05:34,220 --> 00:05:46,480
biologic definition here. Unconsciousness occurs when your ability to maintain an awareness of the

63
00:05:46,480 --> 00:05:53,640
self and the surrounding environment is lost. Now, there's medical unconsciousness and legal

64
00:05:54,180 --> 00:06:02,140
unconsciousness. Medically, someone can be unconscious and unable to respond to stimulus.

65
00:06:02,580 --> 00:06:08,160
But then legally, you can kind of have a loss of consciousness and awareness as a result of maybe

66
00:06:08,160 --> 00:06:16,000
like an altered state due to drugs, delirium, hypnosis. Has anyone ever been so tired,

67
00:06:16,760 --> 00:06:23,680
that you are almost kind of like unable to interact with the world? That would be kind of

68
00:06:23,680 --> 00:06:29,860
a good example of like being kind of maybe legally unconscious. You're still awake and aware,

69
00:06:30,060 --> 00:06:33,160
but you're just, you can't even process anymore at that point.

70
00:06:38,400 --> 00:06:43,700
Subconsciousness. Sigmund Freud, it's like 1893, I think, was when this term was first used.

71
00:06:44,380 --> 00:06:46,360
And he compared the mind to an iceberg.

72
00:06:48,580 --> 00:06:57,960
Pardon me, it's really dry today. He initially used the terms unconscious and subconscious almost

73
00:06:57,960 --> 00:07:02,280
interchangeably, because in his native German, they pretty much, the words sounded the same.

74
00:07:03,640 --> 00:07:13,280
But when I was doing the research on this, there seems to be quite a debate in circles as to what

75
00:07:13,280 --> 00:07:16,460
each one means. And that's why I asked if there was a difference between the two. And I said,

76
00:07:16,480 --> 00:07:22,240
is there any tricks in the audience? Because it seems like there's like a grammatical aspect to the argument,

77
00:07:22,340 --> 00:07:29,720
an academic aspect, and semantic aspect. The best I can tell is when you use the term unconscious,

78
00:07:29,980 --> 00:07:35,500
you're typically referring to a state of awareness from a medical perspective. And when we talk about

79
00:07:35,500 --> 00:07:39,180
subconscious, we're tending to refer to it like when we're talking about psychoanalytical

80
00:07:39,180 --> 00:07:45,220
environments or like instinctual kind of stuff. And so I'm going to differentiate between the two here.

81
00:07:46,480 --> 00:07:53,540
But I will let others debate as they like. I think psychologist Edmund Locke put it the best when he said,

82
00:07:53,640 --> 00:07:59,780
the subconscious is an alternative storehouse of knowledge and prior experience. And that is where when we start

83
00:07:59,780 --> 00:08:04,340
talking about and planning the passwords, that's kind of where that's going to go into.

84
00:08:07,300 --> 00:08:16,080
So there's two main types of memory. There is explicit and implicit. So explicit memory is,

85
00:08:16,480 --> 00:08:23,000
uh, conscious, intentional recollection of factual information, previous experiences and concepts.

86
00:08:23,260 --> 00:08:26,680
So if you think about like when you've taken a test and you're sitting there and you're remembering

87
00:08:27,130 --> 00:08:33,620
the stuff to answer the questions, that is explicit memory. And then there's two categories

88
00:08:33,620 --> 00:08:42,560
of explicit memory. There's episodic and semantic. Episodic is kind of personal experiences. So

89
00:08:43,250 --> 00:08:45,220
that would be remembering a kiss.

90
00:08:46,480 --> 00:08:52,900
And then semantic would be storing factual information. So it would be remembering like facts about a kiss,

91
00:08:53,020 --> 00:08:58,800
data about a kiss, like what temperature was it? You know, were the lips warm or cold?

92
00:08:59,040 --> 00:09:02,080
It was like remembering factual items versus kind of the experience.

93
00:09:03,900 --> 00:09:14,820
And then we have implicit memory. Does anyone here, uh, ride bikes or cyclists? So I trained for triathlons and I actually knew them too.

94
00:09:16,480 --> 00:09:23,280
The reason we train is we're trying to get this like implicit memory trained so that when you actually go to a triathlon,

95
00:09:23,740 --> 00:09:28,540
you're not, you don't have to think as much. You just, you can do because you've practiced so much.

96
00:09:29,340 --> 00:09:34,240
So this is usually acquired and used unconsciously. It can affect your thoughts and behaviors.

97
00:09:36,860 --> 00:09:40,520
And one of the most common forms is a procedural type of learning,

98
00:09:41,440 --> 00:09:46,460
where it's kind of again like riding a bike. You do something enough that you don't even have to do anything.

99
00:09:46,480 --> 00:09:50,720
You don't even have to think about it anymore. You just do it. And that would be kind of an example of your implicit memory.

100
00:09:53,220 --> 00:09:59,240
So this is where we're getting closer to the implanting. We're going to talk about the stages of memory.

101
00:09:59,540 --> 00:10:03,520
So we have encoding, store, encoding, storage, and retrieval.

102
00:10:07,840 --> 00:10:11,180
And encoding is when you put the, put the stuff in your head, basically.

103
00:10:11,560 --> 00:10:15,580
And there are several different ways to encode. You have structural coding.

104
00:10:15,580 --> 00:10:21,820
This could be like learning how to like look at a word. Is it short? Is it long? How many letters does it have? Things like that.

105
00:10:22,520 --> 00:10:27,440
Mnemonic encoding is how it sounds. Semantic encoding would be focusing like on the meaning of it.

106
00:10:29,100 --> 00:10:30,020
With storage,

107
00:10:33,520 --> 00:10:38,100
there's a three-stage model, which I kind of try, I tried to make a chart of.

108
00:10:38,540 --> 00:10:44,700
But essentially you have this, the environmental input comes in through sensory input, and then

109
00:10:45,580 --> 00:10:50,260
it stays in the sensory memory for, I think it can stay in there for like 20 seconds.

110
00:10:50,920 --> 00:10:54,920
And then it's either forgotten, or it moves into your short-term memory.

111
00:10:55,480 --> 00:11:00,960
And then your short-term memory, it can hold things, oh this is where I was, it was 20 seconds.

112
00:11:01,360 --> 00:11:06,180
So it can hold things for like 20 seconds. So if you ever like parked your car and tried to remember like where you put your car, and you're like

113
00:11:06,540 --> 00:11:09,860
P2, P2, P2, blue, you know, you're like kind of trying to get it in there.

114
00:11:10,100 --> 00:11:15,560
That would be an example of maintenance and rehearsal, like trying to keep it in there for that like little short-term memory.

115
00:11:15,580 --> 00:11:19,880
And then you can file it into the long-term and then pull it out later when you come out of your event.

116
00:11:22,860 --> 00:11:29,660
What I thought was really interesting was, once it gets in the long-term memory, supposedly, it's always there.

117
00:11:30,520 --> 00:11:34,200
The big challenge a lot of people have is getting it back out, is the retrieval part.

118
00:11:34,500 --> 00:11:38,660
So it's not that you lose it, it's just that you really can struggle with trying to retrieve it.

119
00:11:38,780 --> 00:11:40,880
That is something chemo brain will do to you.

120
00:11:40,980 --> 00:11:45,500
And I have one of my coworkers here today, they will tell you, I have sat there in meetings,

121
00:11:45,580 --> 00:11:52,720
literally trying to say something, and a simple word like inconsistent or some word like that,

122
00:11:53,800 --> 00:11:55,400
I cannot pull it out of my head.

123
00:11:55,900 --> 00:12:01,540
I will literally not be able to finish a sentence because I can't find a simple word that most people would know.

124
00:12:02,240 --> 00:12:04,940
So there is definitely the retrieval issue.

125
00:12:05,040 --> 00:12:07,260
I know it's in there. I eventually found it.

126
00:12:07,820 --> 00:12:12,280
It just took about two hours and I wrote it on my whiteboard so I could remember it for a couple weeks.

127
00:12:13,160 --> 00:12:15,560
But retrieval is the process of getting the information out.

128
00:12:15,560 --> 00:12:20,320
You can have cues, associations, context, and mood.

129
00:12:22,400 --> 00:12:26,640
So context is when, have you ever lost your keys and then you kind of re-walk through where you were

130
00:12:27,100 --> 00:12:28,780
to try to remember that's context.

131
00:12:29,660 --> 00:12:35,700
Association would be like, let's say I ask you to,

132
00:12:37,500 --> 00:12:41,900
if I show you a picture of these folks on the beach and I ask you to spell the word bear,

133
00:12:42,100 --> 00:12:45,540
you're probably going to spell B-A-R-E versus B-E-A-R-E.

134
00:12:45,560 --> 00:12:47,020
That kind of thing.

135
00:12:47,240 --> 00:12:48,620
And then, of course, mood.

136
00:12:49,300 --> 00:12:54,120
It's kind of like nostalgia if you're somewhere that triggers a certain mood or a smell

137
00:12:54,120 --> 00:12:58,160
and then it takes you back to maybe your childhood and a moment that you remember.

138
00:12:58,680 --> 00:13:01,240
So moods can be very strong retrieval cues.

139
00:13:02,280 --> 00:13:04,200
So passwords and human memory limitations.

140
00:13:06,000 --> 00:13:09,120
Human brain consists of about a billion neurons.

141
00:13:09,660 --> 00:13:12,860
Each neuron forms about a thousand connections to other neurons.

142
00:13:13,400 --> 00:13:15,540
And if each neuron could only help store one,

143
00:13:15,560 --> 00:13:18,180
or a single memory, you actually probably would run out of space pretty quick.

144
00:13:18,400 --> 00:13:21,100
I think you might only have maybe a few gigabytes of storage.

145
00:13:21,940 --> 00:13:25,720
But neurons combine, so each one helps with many memories at a time,

146
00:13:25,820 --> 00:13:31,480
so it exponentially increases your brain's storage capacity to about 2.5 petabytes.

147
00:13:32,780 --> 00:13:38,560
I think they said it would be around 3 million hours of TV shows that you can store with what your brain has,

148
00:13:38,700 --> 00:13:39,880
if it's healthy and working.

149
00:13:43,120 --> 00:13:43,600
Now.

150
00:13:43,600 --> 00:13:45,900
I'm going to skip that because we don't have time.

151
00:13:46,860 --> 00:13:48,720
Now, because you're the biohacking folks,

152
00:13:48,900 --> 00:13:55,480
you guys are probably pretty good BCI brain computer interface.

153
00:13:56,300 --> 00:13:56,820
Okay.

154
00:13:57,980 --> 00:14:01,100
So some of the real quick research I wanted to mention,

155
00:14:01,220 --> 00:14:03,200
because I think there's just not time to do all of it.

156
00:14:03,880 --> 00:14:08,040
Dr. J.W. Wolf, oh wait, Niels Berbanger,

157
00:14:08,200 --> 00:14:10,920
he has this thought translation device.

158
00:14:10,920 --> 00:14:16,880
It allows users to compose phrases and sentences just by thinking them.

159
00:14:17,280 --> 00:14:20,840
I will have a slide of sources, like citations,

160
00:14:20,920 --> 00:14:22,840
because being a grad student, I cite everything.

161
00:14:23,340 --> 00:14:27,660
So I'll have a site at the end of these if you're interested in following up some more on it.

162
00:14:28,240 --> 00:14:31,660
But there's four key pieces of research I really wanted to go over.

163
00:14:31,740 --> 00:14:33,280
The first one is called CISL.

164
00:14:37,580 --> 00:14:38,800
I'm doing something wrong.

165
00:14:43,660 --> 00:14:47,180
This one, Serial Interception Sequence Learning.

166
00:14:47,960 --> 00:14:52,840
This was the one that I stumbled upon first that I thought was pretty fascinating

167
00:14:52,840 --> 00:14:56,860
and it kind of pulled me in to look some more into it.

168
00:14:57,040 --> 00:14:58,440
And I'm going to murder his name.

169
00:14:58,660 --> 00:15:01,360
So if he's watching this on YouTube in two years, like I'm so sorry.

170
00:15:02,560 --> 00:15:04,400
Hristo Bozhanov at Stanford.

171
00:15:04,720 --> 00:15:06,300
And he was working with some guys,

172
00:15:06,540 --> 00:15:08,780
some cognitive scientists at Northwestern University.

173
00:15:08,800 --> 00:15:11,520
And then there was some dude from SRI, I think, in the mix.

174
00:15:12,800 --> 00:15:18,820
He created this program, I guess you would call it.

175
00:15:19,100 --> 00:15:24,740
And it uses implicit learning to put a password into your head.

176
00:15:25,120 --> 00:15:27,720
And the idea is, is you put the password in

177
00:15:27,720 --> 00:15:29,820
and then if someone asks you your password,

178
00:15:30,840 --> 00:15:32,680
you really can't tell them what it is

179
00:15:32,680 --> 00:15:34,280
because you can't remember it,

180
00:15:34,360 --> 00:15:37,380
but you can do it, you can perform it.

181
00:15:37,380 --> 00:15:41,400
And I think the best way, the easiest example is,

182
00:15:41,440 --> 00:15:44,700
how many of you have like the proper really long password that you should have?

183
00:15:44,840 --> 00:15:45,900
Like really complicated, right?

184
00:15:46,500 --> 00:15:47,760
Oh, more hands should be up.

185
00:15:47,940 --> 00:15:48,560
Especially deaf.

186
00:15:49,700 --> 00:15:52,300
And you know how sometimes like you don't remember your password,

187
00:15:52,400 --> 00:15:54,160
but if you put your fingers down, you could do it?

188
00:15:54,940 --> 00:15:56,500
That's basically the gist.

189
00:15:56,500 --> 00:15:58,300
It's just way more complicated and fancy.

190
00:15:58,540 --> 00:16:00,980
So I'm going to actually go through this,

191
00:16:01,020 --> 00:16:02,180
like I'm going to read this to you

192
00:16:02,180 --> 00:16:05,060
because retrieval is not working as far as the details on this.

193
00:16:05,240 --> 00:16:07,360
So the process for learning the password,

194
00:16:07,380 --> 00:16:10,420
involves the use of a specially crafted computer game

195
00:16:10,420 --> 00:16:11,720
that resembles Guitar Hero.

196
00:16:12,060 --> 00:16:15,180
And there's six buttons, S, D, F, J, K and L.

197
00:16:15,400 --> 00:16:17,760
And the user has to hit the corresponding key note

198
00:16:17,760 --> 00:16:19,100
when the circle reaches the bottom

199
00:16:19,100 --> 00:16:21,780
or where like the fret would be on the game in Guitar Hero.

200
00:16:22,580 --> 00:16:24,480
During a typical training session,

201
00:16:24,800 --> 00:16:26,860
would you turn my, I'm sorry,

202
00:16:26,900 --> 00:16:28,620
my alarm goes off every morning at 10.30.

203
00:16:28,700 --> 00:16:29,160
I apologize.

204
00:16:31,620 --> 00:16:34,240
During a typical training session of around 45 minutes,

205
00:16:34,320 --> 00:16:36,280
a user makes about 4,000 keystrokes.

206
00:16:36,280 --> 00:16:38,460
Around 80% of these keystrokes

207
00:16:38,460 --> 00:16:41,000
are being used to subconsciously teach you

208
00:16:41,000 --> 00:16:42,440
a 30-character password.

209
00:16:43,180 --> 00:16:44,520
So before running,

210
00:16:44,640 --> 00:16:47,320
the game creates a random sequence of 30 letters

211
00:16:47,320 --> 00:16:50,340
chosen from these here with no repeating characters.

212
00:16:50,680 --> 00:16:53,300
And it equates to around 38 bits of entropy.

213
00:16:54,000 --> 00:16:57,220
So this 30-character sequence is played back to the user

214
00:16:57,220 --> 00:16:58,100
three times in a row

215
00:16:58,100 --> 00:17:00,320
and then padded out with 18 random characters.

216
00:17:00,720 --> 00:17:02,520
And by this point,

217
00:17:02,700 --> 00:17:04,280
their experimental results suggest

218
00:17:04,280 --> 00:17:06,260
the 30-letter password is firmly involved.

219
00:17:06,280 --> 00:17:08,340
It's implanted in the subconscious brain.

220
00:17:08,760 --> 00:17:10,460
And so the authentication requires

221
00:17:10,460 --> 00:17:12,120
that you play a round of the game,

222
00:17:12,300 --> 00:17:14,280
but this time the 30-letter sequence

223
00:17:14,280 --> 00:17:17,240
is interspersed with other random sequences.

224
00:17:17,700 --> 00:17:19,280
So you're playing the game

225
00:17:19,280 --> 00:17:20,760
and they're giving you the stuff,

226
00:17:20,980 --> 00:17:24,140
but inserted in is the actual password.

227
00:17:24,380 --> 00:17:26,140
And so to pass the authentication,

228
00:17:26,220 --> 00:17:28,720
you have to reliably perform your sequence.

229
00:17:29,520 --> 00:17:32,840
And the research shows that even after about two weeks,

230
00:17:32,900 --> 00:17:34,820
you're still able to recall the sequence pretty well

231
00:17:34,820 --> 00:17:35,580
when you're doing it.

232
00:17:35,940 --> 00:17:37,720
So I thought that was pretty neat.

233
00:17:38,540 --> 00:17:40,760
And then the next one was past thoughts.

234
00:17:41,020 --> 00:17:42,920
And this is from the guys at Berkeley.

235
00:17:43,540 --> 00:17:45,600
They came up with this one,

236
00:17:45,660 --> 00:17:46,880
and it combines three factors.

237
00:17:46,940 --> 00:17:48,340
Something you know, which is a thought,

238
00:17:48,480 --> 00:17:50,720
something you are, which are brain patterns,

239
00:17:50,820 --> 00:17:53,100
and something you have, which is the EEG sensor

240
00:17:53,100 --> 00:17:54,320
for measuring brain waves.

241
00:17:54,780 --> 00:17:58,000
So to authenticate, you think your secret key

242
00:17:58,000 --> 00:17:59,680
while you wear the sensor.

243
00:17:59,900 --> 00:18:03,300
And it can be anything, a song, a phrase, a mental image.

244
00:18:03,300 --> 00:18:05,560
The thought itself is never transmitted,

245
00:18:05,740 --> 00:18:07,260
just the mathematical representation

246
00:18:07,260 --> 00:18:09,720
of the electric signals your brain makes

247
00:18:09,720 --> 00:18:11,180
while you're thinking the thought.

248
00:18:12,520 --> 00:18:14,540
And so if someone else were trying to figure out

249
00:18:14,540 --> 00:18:15,360
exactly what you're thinking,

250
00:18:15,600 --> 00:18:18,060
they couldn't impersonate your past thought,

251
00:18:18,260 --> 00:18:21,020
because even, like, if you and I are both thinking

252
00:18:21,020 --> 00:18:21,960
about Led Zeppelin,

253
00:18:22,140 --> 00:18:23,860
we're gonna think about it differently.

254
00:18:24,220 --> 00:18:26,340
You know, even if we're thinking the same song in our head,

255
00:18:26,740 --> 00:18:29,120
you know, it's still gonna be just a little different.

256
00:18:30,100 --> 00:18:32,020
Now this, let's see,

257
00:18:32,020 --> 00:18:34,020
I'm not gonna go into the details on that.

258
00:18:34,100 --> 00:18:35,660
If you want to hear the rest of the details,

259
00:18:35,780 --> 00:18:37,640
I'm actually doing a longer talk in 101 tomorrow.

260
00:18:39,760 --> 00:18:42,320
The next one's on the feasibility of side-channel attacks

261
00:18:42,320 --> 00:18:43,800
with brain-computer interfaces.

262
00:18:44,460 --> 00:18:46,860
Great paper if you have a chance to read it.

263
00:18:47,900 --> 00:18:52,840
These gentlemen looked at using the EEG types of headsets

264
00:18:52,840 --> 00:18:55,440
to see if they can get your private information

265
00:18:55,920 --> 00:18:58,840
with, like, your ATM and your bank PIN

266
00:18:58,840 --> 00:18:59,620
and stuff like that.

267
00:18:59,620 --> 00:19:04,820
And the problem with their attack setup,

268
00:19:04,960 --> 00:19:06,180
and again, their paper's very long,

269
00:19:06,340 --> 00:19:08,200
was it was very intrusive,

270
00:19:08,200 --> 00:19:10,180
and it could easily be detected by the user

271
00:19:10,180 --> 00:19:11,420
if they were trying to do it to you.

272
00:19:11,440 --> 00:19:14,320
But it rolls into this new thing called PEEP.

273
00:19:14,880 --> 00:19:15,900
This is really neat.

274
00:19:15,980 --> 00:19:17,400
And this was actually recently in,

275
00:19:17,540 --> 00:19:18,900
it's on phys.org.

276
00:19:20,100 --> 00:19:23,000
And there is an article by Tiffany Womack,

277
00:19:23,100 --> 00:19:24,620
and I'm gonna read from her article.

278
00:19:25,020 --> 00:19:27,300
Research at the University of Alabama at Birmingham

279
00:19:27,300 --> 00:19:29,240
suggests that brainwave sensing

280
00:19:29,620 --> 00:19:31,340
headsets, also known as EEG,

281
00:19:31,560 --> 00:19:34,740
need better security after a study reveals

282
00:19:34,740 --> 00:19:36,660
hackers could guess a user's passwords

283
00:19:36,660 --> 00:19:38,460
by monitoring their brainwaves.

284
00:19:38,860 --> 00:19:40,280
And these are those headsets,

285
00:19:40,320 --> 00:19:43,200
like if you play video games online with your buddies,

286
00:19:43,480 --> 00:19:46,080
they were using those headsets,

287
00:19:46,180 --> 00:19:47,840
and they were actually able to

288
00:19:47,840 --> 00:19:49,800
put together this thing called PEEP,

289
00:19:49,940 --> 00:19:52,760
and it's passively eavesdropping private input

290
00:19:52,760 --> 00:19:54,020
via brainwave signals.

291
00:19:54,600 --> 00:19:59,260
And they took the research from the other guys

292
00:19:59,260 --> 00:20:00,860
and rolled into it,

293
00:20:00,920 --> 00:20:02,940
and they created this kind of key logger.

294
00:20:03,420 --> 00:20:06,500
And the quote from the gentleman from the team,

295
00:20:07,420 --> 00:20:09,160
as the use of these devices,

296
00:20:09,240 --> 00:20:11,220
like the EEG gaming headsets,

297
00:20:11,220 --> 00:20:11,940
becomes mainstream,

298
00:20:12,300 --> 00:20:16,180
a user may enter passwords or private confidentials

299
00:20:16,180 --> 00:20:17,740
to their computers or mobile phones

300
00:20:17,740 --> 00:20:18,680
while wearing them.

301
00:20:19,260 --> 00:20:21,300
And then they've been studying the potential

302
00:20:21,300 --> 00:20:23,420
of a malicious app, PEEP,

303
00:20:23,560 --> 00:20:24,780
which is their malicious app,

304
00:20:24,960 --> 00:20:26,380
to capture those signals

305
00:20:26,380 --> 00:20:29,500
and then be able to convert them

306
00:20:29,500 --> 00:20:31,640
and guess and infer your keystrokes.

307
00:20:31,900 --> 00:20:35,360
So if you're sitting there and playing a game

308
00:20:35,360 --> 00:20:36,600
and then you pause to do something

309
00:20:36,600 --> 00:20:37,860
but you've still got the headset on,

310
00:20:38,440 --> 00:20:40,340
they have now come up with this malware app

311
00:20:40,340 --> 00:20:41,740
where they can actually steal that.

312
00:20:42,280 --> 00:20:43,340
And let's see.

313
00:20:44,080 --> 00:20:45,840
The algorithm with PEEP

314
00:20:46,580 --> 00:20:48,460
shortened the odds of a hacker's guessing

315
00:20:48,460 --> 00:20:50,000
a four-digit numerical pin

316
00:20:50,000 --> 00:20:52,620
from one in 10,000 to one in 20.

317
00:20:54,080 --> 00:20:54,620
Okay?

318
00:20:55,180 --> 00:20:56,980
And increased the chance of guessing

319
00:20:56,980 --> 00:20:59,000
a six-letter password from about,

320
00:20:59,680 --> 00:21:01,620
what is it, one in 500,000

321
00:21:01,620 --> 00:21:02,820
to roughly one in 500.

322
00:21:03,920 --> 00:21:05,200
Just with their thing.

323
00:21:06,760 --> 00:21:07,980
Now, let's see.

324
00:21:08,420 --> 00:21:09,480
Go through here quick.

325
00:21:09,680 --> 00:21:11,400
So there were a couple interesting things.

326
00:21:11,600 --> 00:21:12,960
I'm going to talk about the hackability.

327
00:21:14,840 --> 00:21:16,960
With CISL, the thing with that

328
00:21:17,620 --> 00:21:21,400
that kind of put me off

329
00:21:21,400 --> 00:21:22,300
was the...

330
00:21:24,620 --> 00:21:25,580
And here we go.

331
00:21:26,080 --> 00:21:27,480
The experiment sizes.

332
00:21:27,800 --> 00:21:30,680
So if you're graduate students or even college,

333
00:21:30,780 --> 00:21:32,180
even high school kids should know this.

334
00:21:32,480 --> 00:21:34,080
The CISL size,

335
00:21:34,520 --> 00:21:37,000
the experiment number one was done with 35 people.

336
00:21:37,420 --> 00:21:39,560
Number two had two groups,

337
00:21:39,640 --> 00:21:40,900
32 and 80 people.

338
00:21:41,060 --> 00:21:43,340
So it's a total of 147 participants

339
00:21:44,100 --> 00:21:45,720
if there were no duplicates.

340
00:21:46,300 --> 00:21:48,380
I don't know how good

341
00:21:48,380 --> 00:21:50,700
a solid sample of 147 people is.

342
00:21:51,040 --> 00:21:53,680
The past thoughts material, from what I could tell,

343
00:21:53,680 --> 00:21:55,880
was only tested on 15 people.

344
00:21:56,780 --> 00:21:59,380
And the side channel attack had 28

345
00:21:59,380 --> 00:22:01,560
and the peep research only had 12 subjects.

346
00:22:02,820 --> 00:22:04,280
So, great research.

347
00:22:04,520 --> 00:22:05,260
Really excited.

348
00:22:05,880 --> 00:22:06,620
Sample sizes,

349
00:22:07,100 --> 00:22:09,120
I don't think we're there yet as far as

350
00:22:09,120 --> 00:22:10,520
this is going to be a thing next week.

351
00:22:11,340 --> 00:22:11,820
Hackability.

352
00:22:12,120 --> 00:22:13,900
I know they talk about rubber hose attacks,

353
00:22:14,160 --> 00:22:16,180
but I really think they're sexifying their papers

354
00:22:16,180 --> 00:22:17,360
because as far as I know,

355
00:22:17,560 --> 00:22:20,720
none of the universities will allow you to beat your...

356
00:22:21,220 --> 00:22:22,660
I mean, I'm being serious.

357
00:22:22,660 --> 00:22:23,940
I mean, you think about it,

358
00:22:23,980 --> 00:22:25,460
but then also if you think about it,

359
00:22:25,500 --> 00:22:27,740
if someone's doing something that's very tuned to their brain,

360
00:22:27,800 --> 00:22:28,420
thinking something,

361
00:22:29,160 --> 00:22:30,420
and then you start beating them,

362
00:22:30,560 --> 00:22:33,020
that's going to kind of corrupt how they think about it,

363
00:22:33,120 --> 00:22:34,760
adding stress, trauma, whatever.

364
00:22:34,960 --> 00:22:36,420
So it's going to garble it anyway.

365
00:22:39,080 --> 00:22:39,660
Let's see.

366
00:22:42,600 --> 00:22:44,600
The attack factor I could think of was

367
00:22:44,600 --> 00:22:46,520
when they're doing the random generation

368
00:22:46,520 --> 00:22:47,880
of what they're going to implant,

369
00:22:48,340 --> 00:22:49,840
I would probably go after it there,

370
00:22:49,980 --> 00:22:51,300
like a random generator attack.

371
00:22:51,300 --> 00:22:53,540
So you don't have to worry so much about this end

372
00:22:53,540 --> 00:22:55,120
if you can attack it on the front end

373
00:22:55,120 --> 00:22:56,080
with the random generation

374
00:22:56,080 --> 00:22:57,700
so you can kind of get to it there.

375
00:22:58,780 --> 00:23:01,160
CISL was not designed to prevent eavesdropping

376
00:23:01,160 --> 00:23:01,940
or shoulder surfing,

377
00:23:02,160 --> 00:23:04,140
so they did say that that was potentially

378
00:23:04,140 --> 00:23:05,760
another avenue of attack.

379
00:23:06,640 --> 00:23:09,420
And CISL is a flash application

380
00:23:10,000 --> 00:23:11,520
for whatever that's worth with you.

381
00:23:12,420 --> 00:23:14,620
And also my big issue with CISL was

382
00:23:15,500 --> 00:23:18,360
great for kids my daughter's age,

383
00:23:18,420 --> 00:23:21,140
but what about people like my dad?

384
00:23:21,300 --> 00:23:23,360
You know, he's like in his 70s

385
00:23:23,360 --> 00:23:26,880
and maybe isn't really going to be able

386
00:23:26,880 --> 00:23:27,800
to do stuff like that.

387
00:23:27,960 --> 00:23:29,480
And then the other big issue I think was

388
00:23:29,480 --> 00:23:32,540
it took 45 minutes a session.

389
00:23:32,720 --> 00:23:34,020
So if you're like Lockheed Martin

390
00:23:34,020 --> 00:23:35,560
and you've got to give all your people new passwords,

391
00:23:37,260 --> 00:23:38,420
okay, that's going to take a while.

392
00:23:38,680 --> 00:23:40,160
You've got 10 people, you're probably okay,

393
00:23:40,340 --> 00:23:43,780
but is this like really from a big rollout thing?

394
00:23:43,840 --> 00:23:45,920
I'm not seeing this as being really viable right now.

395
00:23:46,180 --> 00:23:49,400
So I want to close by saying

396
00:23:49,860 --> 00:23:51,280
I will have a lot more information tomorrow

397
00:23:51,300 --> 00:23:52,880
because this was just kind of a short teaser.

398
00:23:53,200 --> 00:23:54,800
And if anyone's super interested,

399
00:23:55,000 --> 00:23:58,140
I will have these sent out with the citations.

400
00:23:58,380 --> 00:23:59,860
And you don't have to trust my links.

401
00:23:59,920 --> 00:24:02,080
You can Google that because I don't click on anything

402
00:24:02,080 --> 00:24:03,100
from here, even my own stuff.

403
00:24:03,420 --> 00:24:05,020
And then this, if you're really interested

404
00:24:05,020 --> 00:24:06,680
and you like to read, this is kind of neat.

405
00:24:06,760 --> 00:24:07,880
This was a book from 1985.

406
00:24:08,600 --> 00:24:10,460
It's called Hard-Boiled Wonderland

407
00:24:10,460 --> 00:24:11,300
and the End of the World.

408
00:24:11,480 --> 00:24:12,720
It's by a Japanese author.

409
00:24:14,020 --> 00:24:16,200
And it's actually interesting,

410
00:24:16,460 --> 00:24:17,520
and I'm not going to give any spoilers,

411
00:24:17,780 --> 00:24:19,660
but one narrator is a calcutech.

412
00:24:19,660 --> 00:24:22,520
It's a human data processor encryption system

413
00:24:22,520 --> 00:24:24,380
who's been trained how to use his subconscious

414
00:24:24,380 --> 00:24:25,700
as an encryption key.

415
00:24:26,400 --> 00:24:28,520
And the other narrator is a newcomer

416
00:24:28,520 --> 00:24:30,100
to a strange, isolated town.

417
00:24:30,720 --> 00:24:33,060
So if you're into that kind of stuff,

418
00:24:33,120 --> 00:24:34,200
you might enjoy this book

419
00:24:34,200 --> 00:24:36,580
because I found out about it after I started the research,

420
00:24:36,660 --> 00:24:38,420
and I thought it was neat that in 1985

421
00:24:38,420 --> 00:24:40,340
they were already thinking about this.

422
00:24:40,740 --> 00:24:42,140
And I believe I'm out of time.

423
00:24:44,260 --> 00:24:45,660
Do you want me to take questions?

424
00:24:46,020 --> 00:24:46,460
Okay.

425
00:24:49,660 --> 00:24:50,300
Thank you.