1
00:00:00,000 --> 00:00:06,760
I'd like to invite Shane on stage to talk about, you know, give us direction in terms of

2
00:00:06,760 --> 00:00:08,060
open-source intelligence. Thank you.

3
00:00:16,760 --> 00:00:26,760
Mic handoff. That was good. You were all worried about it. Performance anxiety, right?

4
00:00:26,760 --> 00:00:36,080
Thank you. All right. Let's see if this works. Because I am cursed with displays not working at

5
00:00:36,080 --> 00:00:45,320
the worst possible time. Everybody, send your good karma to this machine. All right. No

6
00:00:45,320 --> 00:00:56,740
looking. Whoo! What the? All right. All right. All right. All right. All right. All right.

7
00:00:56,760 --> 00:01:06,060
All right. Here we go. Interview. You guys can't see all of the horrible notes I have. So...

8
00:01:06,060 --> 00:01:10,760
my name is Shane McDougal. Yeah, I kind of changed the title of the speech. I'm sorry about that.

9
00:01:11,780 --> 00:01:16,720
This keynote was kind of kicking my ass. Because I was thinking about, you know, talking about the

10
00:01:16,720 --> 00:01:21,560
future of OSINT. And it's like, you know, where we're at right now is really fluid. I mean, talking

11
00:01:22,100 --> 00:01:26,740
long term about where we're going to be is kind of a fool's errand. That said, I still am a

12
00:01:26,740 --> 00:01:31,120
a fool and try to do it at some point in the presentation. But I want to talk about three

13
00:01:31,120 --> 00:01:34,740
different things that I think are really key to the field of open source intelligence and

14
00:01:34,740 --> 00:01:41,440
reconnaissance in general. So seeing is believing and the future of recon and you won't believe

15
00:01:41,440 --> 00:01:46,680
what happens next all kind of tie together in a little bit. So the standard disclosure

16
00:01:46,680 --> 00:01:52,300
right off the bat, this presentation and the ideas and the comments herein are those of

17
00:01:52,300 --> 00:01:57,620
mine and only mine. They don't represent my employers or my clients, even though they should,

18
00:01:57,800 --> 00:02:01,960
right? I mean, if the clients knew what was good for them, they would agree with me. But

19
00:02:01,960 --> 00:02:09,720
managers, right? They were born to disagree. So a little bit about me. I've been a pen

20
00:02:09,720 --> 00:02:16,640
tester since 1989. Spent the first half of my career being a person that attacked systems. I've

21
00:02:16,640 --> 00:02:22,280
spent the second half of my career on the defense side. These days, I've been in the

22
00:02:22,300 --> 00:02:28,560
military. I work on the threat intelligence part of the corporate networks. I work for a major

23
00:02:28,560 --> 00:02:36,820
video gaming company. And most of my days are spent building and writing tools to harvest open

24
00:02:36,820 --> 00:02:45,100
source intelligence data that can help my company identify attackers and that sort of thing. As my

25
00:02:45,100 --> 00:02:50,420
gracious hosts mentioned, I do have two black badges from DEF CON by winning the social engineering

26
00:02:50,420 --> 00:02:51,480
capture the flag.

27
00:02:53,900 --> 00:03:22,280
And I mean, I don't want to sound like a bragger, but it's important to say I'm also the only guy to ever get 100% score in that contest. And I want to stress, you know, not to brag about that, but I completely attribute this, you know, my two successes to, I mean, not completely, but a huge chunk of it was because of the reconnaissance phase that I did, right? I mean, those extra points that put me over the top to give me the perfect score were things that I got from recon that nobody else was doing. And they were techniques that we'll talk about in a little bit.

28
00:03:22,300 --> 00:03:32,080
But Chris, right here, also, he won the SCCTF last year. Chris, we're talking to you. Hey.

29
00:03:33,080 --> 00:03:33,920
Oh, I'm sorry.

30
00:03:37,280 --> 00:03:40,620
Importance of OSINT with social engineering attacks. Critical, would you say?

31
00:03:40,780 --> 00:03:47,300
Absolutely. Absolutely. Asking someone to confirm what you already know is a heck of a lot easier than just asking them what you don't know.

32
00:03:47,420 --> 00:03:51,200
Right. Push polling, right? If you can act and sound critical.

33
00:03:52,580 --> 00:03:56,400
The type of attack you can successfully launch is, just boggle your mind.

34
00:03:56,580 --> 00:04:01,380
The stuff that we've been able to get people to tell over the phone, you're just like, I can't believe you're telling me this, right?

35
00:04:02,140 --> 00:04:02,840
But they do.

36
00:04:04,620 --> 00:04:10,220
So I do want to talk a little bit, though, about my history of predictions, so that you know where I'm coming from.

37
00:04:12,200 --> 00:04:17,300
1988, I guess it was, I was an undergrad at engineering school.

38
00:04:18,380 --> 00:04:21,720
And, you know, one of my professors said, hey, do you want to work with the graduate students?

39
00:04:22,300 --> 00:04:24,100
I'm a graduate student. I'm going to talk about this cool thing called hypertext markup language.

40
00:04:25,280 --> 00:04:27,280
Whatever, you know, get some extra credit.

41
00:04:27,680 --> 00:04:33,880
Went in, spent a day with these guys, and they're like, it's links from text articles to other text articles.

42
00:04:34,540 --> 00:04:35,820
Boop-de-doo, right?

43
00:04:37,140 --> 00:04:40,960
Spent a day, I'm like, yeah, scintillating, I'm out of here, right? Bounce.

44
00:04:41,520 --> 00:04:48,440
Because obviously I didn't, you know, back then, we didn't have Netscape, there were no graphics, no, you know, no videos, none of that stuff.

45
00:04:48,560 --> 00:04:51,080
It was like, articles to articles to articles.

46
00:04:51,380 --> 00:04:51,780
Right?

47
00:04:51,780 --> 00:04:52,280
So that's the thing.

48
00:04:52,280 --> 00:04:56,700
visionary I am, right? I mean, I'm probably the guy that would have gone, Mr. Xerox, I

49
00:04:57,320 --> 00:05:00,420
understand the concept, but I'm not sure there's a market for it, right?

50
00:05:04,020 --> 00:05:08,660
So, Peter Drucker had a great line. He said, predicting the future is like driving down

51
00:05:08,660 --> 00:05:12,760
a country road at night with your headlights off and you're looking out the rear window,

52
00:05:14,700 --> 00:05:18,960
which is pretty close to accurate, I think. But we're going to take a drive anyway.

53
00:05:20,020 --> 00:05:31,100
So, open source intelligence and recon as a tool. What makes OSINT so compelling is

54
00:05:31,100 --> 00:05:38,540
that it's a completely passive process, right? We don't send a single packet to the target.

55
00:05:38,820 --> 00:05:43,260
We send our packets to people that have already hit that target, or the target has already

56
00:05:43,260 --> 00:05:48,280
hit, or people within that company have already hit, right? They have no idea we're targeting

57
00:05:48,280 --> 00:05:48,540
them.

58
00:05:48,960 --> 00:05:53,220
So, if we want to know what technology a company is running, we don't run scans in their network.

59
00:05:53,440 --> 00:05:57,500
I mean, you can later, if you want, or you can up front if you want. But instead, what

60
00:05:57,500 --> 00:06:03,140
I like to do is I go to LinkedIn. I look at every employee, all their future stuff.

61
00:06:03,200 --> 00:06:08,000
What have they hired? What technologies do they have on, right? Retired, current employees.

62
00:06:08,380 --> 00:06:13,400
Go to Indeed. Go to Monster, the job sites. Who are they hiring? What apps are they looking

63
00:06:13,400 --> 00:06:18,560
for? What technology? Just using open source intelligence, you can pretty much do a really

64
00:06:18,560 --> 00:06:18,940
good job.

65
00:06:18,960 --> 00:06:23,860
You can do the high-level technology stack analysis, again, without sending a single

66
00:06:23,860 --> 00:06:26,000
packet to the target, right?

67
00:06:28,800 --> 00:06:32,580
And why does this keep going? So, this is actually what OSINT used to look like. Anybody

68
00:06:32,580 --> 00:06:38,960
remember using this back in, like, 89? Yeah, right? Would I be far off by saying, gigantic

69
00:06:38,960 --> 00:06:45,580
pain in the ass? Right? Finding the little nugget. You're like, I know that they built

70
00:06:45,580 --> 00:06:49,420
this data center out, and I want to find articles about it, but, like, you're scrolling

71
00:06:49,420 --> 00:06:55,240
and scrolling and scrolling. Yeah, it was a nightmare. But this is literally what open

72
00:06:55,240 --> 00:07:00,060
source intelligence and recon was for the longest time. And that's not to say there

73
00:07:00,060 --> 00:07:03,660
wasn't online data available. There certainly was. And ironically enough, back in the day,

74
00:07:03,740 --> 00:07:09,120
I know, old-timer, government data was the most readily accessible. But that's because

75
00:07:09,120 --> 00:07:13,820
they'd actually had databases and data and big stuff. There was a time when government

76
00:07:13,820 --> 00:07:15,320
had their shit together, believe it or not.

77
00:07:16,520 --> 00:07:22,180
I know, hard to believe. Newspapers didn't have their stuff online, though. That's only

78
00:07:22,180 --> 00:07:26,360
very recent, right? You see them on the scanning projects, and that's because now we have Hadoop

79
00:07:26,360 --> 00:07:30,840
clusters, and they can distribute this work, and it's a lot easier for them to do now than

80
00:07:30,840 --> 00:07:35,060
they could back then. LexisNexis, however, did exist back in the time, and that was kind

81
00:07:35,060 --> 00:07:45,180
of like the ultimate source for OSINT or for personal recon. But where are we now? Well,

82
00:07:45,580 --> 00:07:49,680
obviously, as my career has progressed, open source intelligence and successful recon

83
00:07:49,680 --> 00:07:54,740
has become a much bigger part of the attack and defense profiling for most engagements.

84
00:07:55,860 --> 00:08:00,340
This is obviously due to the explosion of the internet and social media, right? We went

85
00:08:00,340 --> 00:08:06,140
from a little tiny drip, drip, drip of data that we could get to the biggest tsunami of

86
00:08:06,140 --> 00:08:10,480
data that the world has ever seen. I mean, if you look at the charts, the amount of data

87
00:08:10,480 --> 00:08:14,680
and the way it's going up, it's just exponential, right? And as OSINT professionals,

88
00:08:15,580 --> 00:08:20,020
this is the field you get into, or recon or doing any sort of this stuff, it's one

89
00:08:20,020 --> 00:08:25,120
of the first things you're going to have to deal with is the data overload, right? It's

90
00:08:26,220 --> 00:08:30,580
unbelievably hard. I mean, we're actually at a point now where we literally have internet

91
00:08:30,580 --> 00:08:38,040
connected toasters. Internet freaking connected toasters. That's more data that we have,

92
00:08:38,220 --> 00:08:45,300
right? But again, it's also a pivot point within, you know, a target. So this was, I

93
00:08:45,580 --> 00:08:51,440
put this up, it's not even close. This was like from four years ago. So take these numbers

94
00:08:51,870 --> 00:08:57,160
and times them by what? A hundred. I don't know what the number is now, but just unbelievable

95
00:08:57,980 --> 00:09:01,720
amounts of data that are surging over the wire at any given time. And these are things

96
00:09:01,720 --> 00:09:05,880
that you are going to want to go through, right? It's like, I want to look for anything

97
00:09:05,880 --> 00:09:09,520
that refers to this piece of data. And we start trawling through this. And this pile,

98
00:09:10,300 --> 00:09:14,500
you're never going to get through this pile because it's growing all the time.

99
00:09:17,220 --> 00:09:21,020
So why do we use open source intelligence? Well, we said before, you know, it's usually

100
00:09:21,020 --> 00:09:26,500
free or at least relatively cheap. I mean, usually to obtain. The data has already been

101
00:09:27,640 --> 00:09:32,060
provided, so we don't have to mine it. Well, I shouldn't say that. We have to get it.

102
00:09:32,080 --> 00:09:37,720
We probably have to mine it, but it's been pre-mined for the most part. The other nice

103
00:09:37,720 --> 00:09:42,980
thing is it's publicly available, which frees us, hopefully, from privacy law violations,

104
00:09:43,240 --> 00:09:45,560
which can be very costly. And we'll talk about that in a minute.

105
00:09:45,580 --> 00:09:54,260
So Wall Street uses open source intelligence so that they can analyze companies. They can

106
00:09:54,260 --> 00:09:59,820
check the supply chains, look at threats to their income streams, and analyze risks, right?

107
00:10:01,680 --> 00:10:06,860
Law enforcement uses it to track people, shut down protests, discover crimes, that sort

108
00:10:06,860 --> 00:10:13,420
of thing, right? NGOs use it to protect their employees because a lot of them are in war

109
00:10:13,420 --> 00:10:13,820
zones.

110
00:10:15,580 --> 00:10:21,100
Interestingly enough, social media, in many cases, is the most honest, up-to-date, real-time

111
00:10:21,100 --> 00:10:27,060
source of truth in war zones, right? So you'll see a lot of NGOs relying very heavily on

112
00:10:27,060 --> 00:10:27,900
mining social media.

113
00:10:29,920 --> 00:10:35,060
And then journalists and others use it to investigate targets, uncover stories, document

114
00:10:35,060 --> 00:10:37,320
war activity and crimes, and that sort of thing.

115
00:10:38,200 --> 00:10:44,380
But in my humble opinion, the most important use of OSINT, well, actually, that's not

116
00:10:44,380 --> 00:10:44,580
true.

117
00:10:45,780 --> 00:10:47,740
This is the second most important thing.

118
00:10:49,460 --> 00:10:54,620
So we can pwn all the things, right? I mean, it really makes our life so much easier. Nobody

119
00:10:54,620 --> 00:10:59,540
else really has a need for OSINT like we do. Babies spy agencies. But other than that,

120
00:10:59,620 --> 00:11:00,760
we really need it to do our job.

121
00:11:02,120 --> 00:11:06,840
But in my opinion, the most important thing that you use OSINT for is online dating.

122
00:11:09,540 --> 00:11:15,560
Anyone here online dating? So I, you know, out of a 20-year marriage, I had a couple

123
00:11:15,580 --> 00:11:15,700
of things.

124
00:11:15,700 --> 00:11:21,780
I, you know, I started online dating for the first time 3 weeks ago, and I'm trying to

125
00:11:21,780 --> 00:11:24,060
think of the word to put for it.

126
00:11:24,100 --> 00:11:25,480
Freaking nightmare, maybe?

127
00:11:26,460 --> 00:11:26,960
Right?

128
00:11:29,120 --> 00:11:34,660
I can't stress the value enough of recon and OSINT in online dating.

129
00:11:36,820 --> 00:11:38,060
Yeah. You know?

130
00:11:39,540 --> 00:11:43,580
It's really good. If you really want to bounce someone who's, you realize this relationship

131
00:11:43,580 --> 00:11:45,560
isn't working out, you can go, oh, I can't find someone. It's really good. If you really want to bounce someone who's, like, you realize this relationship isn't working

132
00:11:46,180 --> 00:11:48,020
You know, quick Google search and hunting.

133
00:11:48,100 --> 00:11:50,500
Hey, are you Libby Morgenstern who lives on 7th

134
00:11:50,500 --> 00:11:53,000
and works at Whole Foods and you've got that dog, Peanut?

135
00:11:53,240 --> 00:11:55,560
And she's like, how do you know that?

136
00:11:56,220 --> 00:11:57,600
Discussion closed, unfriended.

137
00:12:00,040 --> 00:12:00,980
Very good to know.

138
00:12:02,460 --> 00:12:02,820
Right?

139
00:12:05,340 --> 00:12:07,500
Do you think you've met Mrs. Wright or Mr. Wright?

140
00:12:07,640 --> 00:12:09,860
It's really good to be able to look at this

141
00:12:09,860 --> 00:12:13,040
and figure out if this person truly is Mr. or Mrs. Wright.

142
00:12:13,140 --> 00:12:14,720
You can find out a lot of stuff about people

143
00:12:14,720 --> 00:12:15,980
that they haven't let you know yet.

144
00:12:16,400 --> 00:12:19,420
So you just wait for that piece of information to come out.

145
00:12:19,920 --> 00:12:23,960
You know, oh, that teardrop wasn't from the teardrop festival.

146
00:12:24,200 --> 00:12:26,480
It was from your five-year stint at Whole Foods.

147
00:12:26,780 --> 00:12:26,860
Right.

148
00:12:31,000 --> 00:12:34,680
So as we advance, though, I mean, we can use, well, yeah.

149
00:12:35,420 --> 00:12:39,840
We can use, the way I see kind of OSINT evolving with dating apps

150
00:12:39,840 --> 00:12:42,660
is we can actually use image and facial recognition.

151
00:12:42,980 --> 00:12:44,520
We'll be able to harvest, basically,

152
00:12:44,720 --> 00:12:46,620
a treasure trove of local information, right?

153
00:12:46,720 --> 00:12:48,360
You'll be able to swipe with your little swiper,

154
00:12:48,960 --> 00:12:50,560
grab the data, get their profile,

155
00:12:50,880 --> 00:12:52,300
get all the personal information,

156
00:12:52,500 --> 00:12:53,820
and start putting that together

157
00:12:53,820 --> 00:12:56,700
into kind of like our own mini LexisNexis database.

158
00:12:59,320 --> 00:13:00,080
It's really cool.

159
00:13:00,240 --> 00:13:02,080
We can de-anonymize people really easily

160
00:13:02,080 --> 00:13:03,640
and get their intimate details.

161
00:13:04,420 --> 00:13:05,640
And it's really not that hard.

162
00:13:05,700 --> 00:13:07,940
If we built a mini army of these automated swipers,

163
00:13:07,980 --> 00:13:09,860
scrape the data, we can pretty much enumerate

164
00:13:09,860 --> 00:13:12,160
the company's entire database very quickly.

165
00:13:13,480 --> 00:13:14,700
I find OSINT is really, really good.

166
00:13:14,700 --> 00:13:15,280
It's really helpful, too.

167
00:13:15,940 --> 00:13:18,900
It's a great defense tool in online dating, right?

168
00:13:19,040 --> 00:13:20,100
Because I don't know if you've noticed,

169
00:13:20,320 --> 00:13:22,400
I think I must be the only, I know you guys are lying,

170
00:13:22,460 --> 00:13:24,080
I can't be the only person that's online dating.

171
00:13:25,700 --> 00:13:27,600
But I've learned the rules of online dating,

172
00:13:27,700 --> 00:13:29,560
and that's if every photo is from up here,

173
00:13:31,120 --> 00:13:34,560
and the duck lips, right, they're hiding something.

174
00:13:35,820 --> 00:13:36,980
Usually 100 pounds.

175
00:13:39,800 --> 00:13:41,540
So it's a really good defense tool

176
00:13:41,540 --> 00:13:44,500
because you can actually find out someone's true,

177
00:13:44,700 --> 00:13:45,120
true and fake information.

178
00:13:45,120 --> 00:13:45,500
of this kind of useful stuff, right?

179
00:13:46,420 --> 00:13:48,240
So in my dating world, I just wanna give you

180
00:13:48,240 --> 00:13:49,800
a couple of quick examples that have happened to me.

181
00:13:50,760 --> 00:13:53,400
Just with a first name on a dating app,

182
00:13:53,500 --> 00:13:55,080
you can get a ton of information, right?

183
00:13:55,220 --> 00:13:58,320
So one of the first people I started dating was a nurse,

184
00:13:58,380 --> 00:13:59,820
got a very unusual first name.

185
00:14:00,560 --> 00:14:04,320
So I put in first name and nurse, and Googled,

186
00:14:04,440 --> 00:14:06,500
and it gave me four hits in the US.

187
00:14:07,720 --> 00:14:08,380
Four hits.

188
00:14:09,900 --> 00:14:11,160
That's pretty narrow, right?

189
00:14:11,720 --> 00:14:13,420
Now she had a very run of the name.

190
00:14:13,460 --> 00:14:14,540
If her name was Susan Nurse,

191
00:14:15,380 --> 00:14:18,440
she'd probably have like, what, 50,000, 50 million hits?

192
00:14:20,380 --> 00:14:21,620
So it was kind of interesting.

193
00:14:21,720 --> 00:14:24,980
I matched an image I had of her to an image I had a name,

194
00:14:25,080 --> 00:14:26,300
and all of a sudden, now I had last name,

195
00:14:26,360 --> 00:14:27,200
now I start digging, right?

196
00:14:27,280 --> 00:14:28,600
It all comes together real quick.

197
00:14:29,520 --> 00:14:31,380
So I was able to find property she owned,

198
00:14:31,520 --> 00:14:32,900
court action against her, family tree,

199
00:14:33,080 --> 00:14:34,260
you name it, the whole thing.

200
00:14:35,920 --> 00:14:39,940
Second thing happened earlier, or sorry, later that week.

201
00:14:40,040 --> 00:14:42,940
I met another woman, had another very unique name.

202
00:14:43,420 --> 00:14:44,200
And from that,

203
00:14:44,200 --> 00:14:46,360
I was able to, I saw on the dating app

204
00:14:46,360 --> 00:14:48,600
that she was 0.6 miles from my place.

205
00:14:48,840 --> 00:14:51,320
So, took a little protractor on a map,

206
00:14:51,920 --> 00:14:53,920
know the neighborhood she's going to be in,

207
00:14:54,060 --> 00:14:55,700
put in her first name, the neighborhood,

208
00:14:56,000 --> 00:15:00,100
and within seconds, I had her motorcycle makes and model,

209
00:15:00,260 --> 00:15:02,180
her address, her occupation, her hangouts,

210
00:15:02,260 --> 00:15:03,740
pretty much everything, right?

211
00:15:04,160 --> 00:15:06,180
Just because she had a unique first name.

212
00:15:06,280 --> 00:15:07,800
Although the really weird thing was,

213
00:15:08,020 --> 00:15:10,080
there were actually two people in my neighborhood

214
00:15:10,080 --> 00:15:11,480
with that unique first name.

215
00:15:12,040 --> 00:15:13,460
So at first, I was all excited.

216
00:15:13,540 --> 00:15:14,180
She's a doctor!

217
00:15:14,180 --> 00:15:14,820
She's a doctor!

218
00:15:15,020 --> 00:15:15,420
I'm going to be rich!

219
00:15:15,760 --> 00:15:16,920
She was like, no, she's not a doctor.

220
00:15:18,000 --> 00:15:19,820
You're going to have to keep working, you lazy bum.

221
00:15:25,240 --> 00:15:28,380
So what makes OSINT and Recon so powerful for us as hackers?

222
00:15:29,100 --> 00:15:30,820
Well, as an attack tool, like I said before,

223
00:15:30,920 --> 00:15:33,400
it's as critical, if not more critical,

224
00:15:33,560 --> 00:15:34,820
than pretty much every other stage

225
00:15:34,820 --> 00:15:37,160
or every other phase of a pen test, right?

226
00:15:37,760 --> 00:15:39,720
The proper intelligence gathered can be used

227
00:15:39,720 --> 00:15:42,140
in a devastating social engineering attack.

228
00:15:42,400 --> 00:15:43,800
And I mean, I've lost track.

229
00:15:44,180 --> 00:15:47,360
The number of times in my life I've been able to come in

230
00:15:47,360 --> 00:15:55,520
and drop slang, internal project names, site locations,

231
00:15:55,840 --> 00:15:57,220
that sort of stuff, right?

232
00:15:57,280 --> 00:15:59,220
The old adage, if you look and act like you belong there,

233
00:15:59,280 --> 00:16:00,480
people are going to assume you belong.

234
00:16:03,240 --> 00:16:06,280
Using OSINT, you can gather just insane things.

235
00:16:06,620 --> 00:16:09,500
One of the courses I taught a few years ago at Black Hat

236
00:16:09,940 --> 00:16:12,940
was I had teams go out and they were assigned

237
00:16:12,940 --> 00:16:13,860
different companies.

238
00:16:14,180 --> 00:16:18,700
And one of my team, I assigned them, just as it was a lark,

239
00:16:18,820 --> 00:16:20,900
one of the largest defense contractors in the world.

240
00:16:21,760 --> 00:16:22,920
I'm not going to say the name.

241
00:16:23,980 --> 00:16:24,880
I'm too Chinese.

242
00:16:27,280 --> 00:16:31,560
And they were able to find everything from employee names,

243
00:16:31,820 --> 00:16:34,020
addresses, social security numbers, salaries,

244
00:16:34,720 --> 00:16:39,260
black site addresses, locations around the world, you name it.

245
00:16:40,120 --> 00:16:41,660
And they found that within an hour.

246
00:16:42,140 --> 00:16:43,700
This is one of our most critical,

247
00:16:43,700 --> 00:16:44,760
critical pieces of infrastructure.

248
00:16:45,000 --> 00:16:46,760
And they were able to find this information within an hour

249
00:16:46,760 --> 00:16:47,500
on the internet.

250
00:16:51,440 --> 00:16:54,080
Like I said, this is the stuff you want to catch.

251
00:16:54,220 --> 00:16:55,960
The TPS cover sheet report.

252
00:16:56,520 --> 00:16:57,640
TPS report cover sheet.

253
00:16:58,260 --> 00:17:01,720
So a physical layout, email addresses, phone numbers,

254
00:17:01,940 --> 00:17:03,120
network diagrams, software.

255
00:17:03,440 --> 00:17:04,760
That's the sort of stuff we're looking for.

256
00:17:06,520 --> 00:17:07,980
So with an open source intelligence,

257
00:17:08,120 --> 00:17:09,920
how many people here are really familiar with OSINT?

258
00:17:10,140 --> 00:17:11,560
I should have asked that right off the bat.

259
00:17:12,020 --> 00:17:12,460
OK.

260
00:17:12,820 --> 00:17:13,680
So there's a lot that aren't.

261
00:17:14,160 --> 00:17:16,200
So there are actually many, many different types

262
00:17:16,200 --> 00:17:17,140
of open source intelligence.

263
00:17:17,540 --> 00:17:19,540
Open source intelligence, do you even know what that means?

264
00:17:19,640 --> 00:17:21,360
I guess I should have really framed what that is, right?

265
00:17:21,820 --> 00:17:22,220
Sorry.

266
00:17:23,440 --> 00:17:25,580
Open source intelligence is basically

267
00:17:25,580 --> 00:17:27,900
intelligence that we get that's out there,

268
00:17:27,940 --> 00:17:28,740
that's publicly available.

269
00:17:29,980 --> 00:17:31,100
That's open source intelligence.

270
00:17:32,340 --> 00:17:33,400
It can be on a website.

271
00:17:33,620 --> 00:17:36,560
It can be stuff that we grab from talking to people, whatever.

272
00:17:37,040 --> 00:17:39,300
But there are different ways, different types of methods,

273
00:17:39,480 --> 00:17:41,860
or different types, sources of open source intelligence.

274
00:17:41,960 --> 00:17:42,780
There's human intelligence.

275
00:17:43,120 --> 00:17:44,140
Cultural intelligence.

276
00:17:45,120 --> 00:17:46,580
Geospatial intelligence, I think it's called.

277
00:17:47,100 --> 00:17:47,780
Market intelligence.

278
00:17:48,160 --> 00:17:48,860
Signal intelligence.

279
00:17:49,080 --> 00:17:49,780
Technical intelligence.

280
00:17:50,680 --> 00:17:51,500
Image intelligence.

281
00:17:51,880 --> 00:17:52,620
And what's MassINT?

282
00:17:52,700 --> 00:17:53,360
I can't even remember.

283
00:17:56,240 --> 00:17:56,900
Sounds good.

284
00:17:57,020 --> 00:17:57,960
I didn't even hear what you said.

285
00:17:58,120 --> 00:17:58,780
Sounds good.

286
00:18:00,820 --> 00:18:02,320
But there are tons of OSINT sources.

287
00:18:02,580 --> 00:18:04,620
And predicting the future of each and every one of these

288
00:18:05,220 --> 00:18:07,780
could be a conference into and of itself, right?

289
00:18:09,000 --> 00:18:12,760
So what I'm going to talk about today is, you know,

290
00:18:12,760 --> 00:18:15,440
the one type of open source intelligence

291
00:18:15,440 --> 00:18:17,400
that I feel is woefully underused.

292
00:18:17,600 --> 00:18:21,020
And I say that because I know people that pen test every day.

293
00:18:21,120 --> 00:18:21,680
I've seen it.

294
00:18:21,760 --> 00:18:22,560
I've done it myself.

295
00:18:23,360 --> 00:18:24,700
And I know they don't do it.

296
00:18:24,720 --> 00:18:25,440
People don't do it.

297
00:18:25,440 --> 00:18:26,440
And they don't do it for a few reasons.

298
00:18:26,540 --> 00:18:27,520
And we'll show why.

299
00:18:29,180 --> 00:18:31,100
But my favorite type of intelligence

300
00:18:31,100 --> 00:18:32,400
is called image intelligence.

301
00:18:32,740 --> 00:18:34,720
And that's where, try and guess it,

302
00:18:34,840 --> 00:18:37,500
we get intelligence from...

303
00:18:37,500 --> 00:18:38,120
Whew.

304
00:18:38,300 --> 00:18:39,580
You guys are super smart.

305
00:18:40,120 --> 00:18:40,720
Ha-ha.

306
00:18:40,720 --> 00:18:44,140
I mean, the stuff that you can grab from image intelligence

307
00:18:44,140 --> 00:18:45,220
is just unbelievable.

308
00:18:45,540 --> 00:18:49,160
And it's stuff that you will often only find in images.

309
00:18:50,300 --> 00:18:51,800
Now, remember before I was talking about

310
00:18:51,800 --> 00:18:54,320
all the different things that we could look for in an attack,

311
00:18:54,460 --> 00:18:57,420
like email addresses, physical layouts of properties,

312
00:18:57,620 --> 00:18:59,240
and network diagrams,

313
00:18:59,340 --> 00:19:01,380
and all the stuff we'd really want as hackers

314
00:19:02,120 --> 00:19:03,260
to break into a company.

315
00:19:03,940 --> 00:19:05,620
Well, we can find those things.

316
00:19:07,060 --> 00:19:07,500
So...

317
00:19:09,220 --> 00:19:10,100
This guy...

318
00:19:10,100 --> 00:19:13,680
If you've seen some of my talks,

319
00:19:13,740 --> 00:19:14,780
sometimes I talk about this guy

320
00:19:14,780 --> 00:19:17,000
because he's just one of my favorite targets.

321
00:19:19,340 --> 00:19:20,160
You'll see why.

322
00:19:21,700 --> 00:19:24,200
So I stumbled across this guy's Flickr account

323
00:19:24,200 --> 00:19:25,560
a few years ago

324
00:19:25,560 --> 00:19:27,240
and decided he was really worth checking out

325
00:19:27,240 --> 00:19:29,280
for a variety of reasons, which you'll soon see.

326
00:19:29,820 --> 00:19:32,900
But just from him posting this business card,

327
00:19:33,060 --> 00:19:34,120
what did we grab from it?

328
00:19:35,240 --> 00:19:37,060
We got his cell phone,

329
00:19:37,300 --> 00:19:38,220
his work address,

330
00:19:38,540 --> 00:19:39,340
his work phone,

331
00:19:39,340 --> 00:19:41,380
his fax address, right?

332
00:19:42,340 --> 00:19:43,820
That's pretty good to know.

333
00:19:43,840 --> 00:19:45,020
And his employer, right?

334
00:19:45,760 --> 00:19:46,720
That's good stuff to know.

335
00:19:49,220 --> 00:19:49,540
So...

336
00:19:50,440 --> 00:19:53,360
I started looking at his Flickr account, too,

337
00:19:53,400 --> 00:19:54,120
and he posted this one.

338
00:19:54,300 --> 00:19:55,960
So I started to grab some other things

339
00:19:55,960 --> 00:19:57,280
I gleaned about his hobbies and his life.

340
00:19:57,360 --> 00:19:59,180
So what did we get from this Flickr upload?

341
00:20:02,100 --> 00:20:02,620
Carrier, correct?

342
00:20:03,400 --> 00:20:05,140
And he's got a sucky battery life, right?

343
00:20:05,280 --> 00:20:05,720
So there we go.

344
00:20:05,800 --> 00:20:07,640
So we know he is an AT&T character,

345
00:20:08,180 --> 00:20:10,700
and we know he's on an Apple,

346
00:20:10,840 --> 00:20:12,260
on an iPhone, right?

347
00:20:12,360 --> 00:20:14,260
Which is important if we're going to launch an attack on him.

348
00:20:16,220 --> 00:20:17,460
So we have a cell phone number.

349
00:20:17,900 --> 00:20:19,980
Let's see if we mesh it with AT&T.

350
00:20:20,020 --> 00:20:22,360
So we went and we plugged it into one of these databases,

351
00:20:22,480 --> 00:20:24,920
and sure enough, he is on AT&T.

352
00:20:25,000 --> 00:20:26,840
So we can be pretty sure

353
00:20:26,840 --> 00:20:29,560
that if he gets a call from AT&T technical support

354
00:20:30,100 --> 00:20:30,920
or sales support,

355
00:20:32,000 --> 00:20:33,340
probably won't bat an eye, right?

356
00:20:33,560 --> 00:20:34,760
It's a legit call.

357
00:20:34,900 --> 00:20:35,640
We know his number.

358
00:20:35,720 --> 00:20:36,400
He's AT&T.

359
00:20:36,520 --> 00:20:36,880
Right?

360
00:20:39,300 --> 00:20:41,380
So this was another one that he posted on Flickr.

361
00:20:41,440 --> 00:20:42,900
And it was starting to get more and more interesting

362
00:20:42,900 --> 00:20:43,980
as I was going through his account.

363
00:20:44,160 --> 00:20:45,940
And he was talking about an event on Eventful

364
00:20:45,940 --> 00:20:46,980
that he had registered for.

365
00:20:47,060 --> 00:20:47,860
He goes, you know, fail.

366
00:20:48,040 --> 00:20:49,880
Eventful is a little too helpful with email addresses.

367
00:20:50,680 --> 00:20:52,200
With email address correction, he said,

368
00:20:52,240 --> 00:20:53,780
this isn't even my real email address,

369
00:20:53,920 --> 00:20:56,420
but earthling.net is the correct domain.

370
00:20:56,620 --> 00:20:58,500
So I'm like, oh, good to know.

371
00:20:58,660 --> 00:21:00,820
So he's got an earthling.net email account.

372
00:21:02,120 --> 00:21:03,640
And then he posted a follow-up,

373
00:21:03,640 --> 00:21:05,240
which is, you know, the event fail-fail

374
00:21:05,240 --> 00:21:06,420
just keep getting worse.

375
00:21:06,420 --> 00:21:08,640
You know, this time with my real email address.

376
00:21:08,960 --> 00:21:09,320
Fail.

377
00:21:10,560 --> 00:21:13,320
I'm like, dude, you just told us your real email address.

378
00:21:14,160 --> 00:21:15,200
So there we go.

379
00:21:16,860 --> 00:21:18,740
And then he started posting things, you know,

380
00:21:18,800 --> 00:21:20,740
he posts a lot of other things,

381
00:21:20,800 --> 00:21:21,500
but he posts work,

382
00:21:21,600 --> 00:21:22,980
pics of his work-related hardware,

383
00:21:23,160 --> 00:21:25,900
including specific hardware like wireless adapters.

384
00:21:26,020 --> 00:21:27,620
That's probably something we'd want to know, right?

385
00:21:28,400 --> 00:21:29,040
Specific attacks.

386
00:21:31,140 --> 00:21:32,640
And then he had a bunch of photos

387
00:21:32,640 --> 00:21:34,740
of him doing asset scanning at some school.

388
00:21:35,480 --> 00:21:36,260
And in this one,

389
00:21:36,420 --> 00:21:38,020
we start to see some really helpful information.

390
00:21:38,340 --> 00:21:40,240
He's scanning at Bird Rock Elementary School.

391
00:21:40,440 --> 00:21:42,520
And I do a quick check of Google,

392
00:21:42,580 --> 00:21:43,360
which shows me that's part of

393
00:21:43,360 --> 00:21:44,780
the San Diego Unified School District.

394
00:21:45,500 --> 00:21:47,160
I know from other posts he's made

395
00:21:47,160 --> 00:21:48,360
that he used to work there,

396
00:21:48,440 --> 00:21:49,920
so now I know he still is working there.

397
00:21:50,160 --> 00:21:52,080
So, right, another piece of information.

398
00:21:53,400 --> 00:21:55,900
He's using the Airy Jones Asset Scanning Program.

399
00:21:56,040 --> 00:21:58,680
And we can see the school's code is 0029A.

400
00:21:59,340 --> 00:22:00,540
Pretty useful information

401
00:22:00,540 --> 00:22:02,700
if you get a schmoozer like me on the phone, right?

402
00:22:03,020 --> 00:22:03,860
Or in person.

403
00:22:04,520 --> 00:22:05,660
This could be very useful.

404
00:22:05,660 --> 00:22:06,480
Also helpful,

405
00:22:06,680 --> 00:22:09,040
the IP address of the laser printer there on the back.

406
00:22:09,160 --> 00:22:09,980
I don't know if you see it,

407
00:22:10,040 --> 00:22:12,000
but they've got it sharpied on the upper right corner.

408
00:22:13,440 --> 00:22:15,460
10-40-17-252.

409
00:22:15,740 --> 00:22:17,960
So, people, please do not hack this school.

410
00:22:19,120 --> 00:22:20,160
No hacking the schools.

411
00:22:22,220 --> 00:22:23,860
Here's another innocuous pic he took

412
00:22:23,860 --> 00:22:25,640
of him doing the asset survey.

413
00:22:25,840 --> 00:22:26,980
You notice, by the way,

414
00:22:27,040 --> 00:22:28,460
right before his face, what's that?

415
00:22:29,680 --> 00:22:30,780
Yeah, a map of the school.

416
00:22:30,940 --> 00:22:33,780
And in other following pictures that he posts,

417
00:22:33,880 --> 00:22:35,380
we basically see the entire layout

418
00:22:35,380 --> 00:22:36,380
of the building, the facility.

419
00:22:40,760 --> 00:22:43,380
So, this at first glance looks kind of useless,

420
00:22:43,720 --> 00:22:46,040
but what I did was I ran it through a high-res version,

421
00:22:46,260 --> 00:22:48,200
took a high-res version, exported it,

422
00:22:48,260 --> 00:22:51,340
put it in Photoshop, ran a high-pass filter on it,

423
00:22:51,400 --> 00:22:53,040
and then I was able to start pulling out stuff, right?

424
00:22:53,580 --> 00:22:56,220
So, how the bunch of laptops that they're scanning

425
00:22:56,220 --> 00:22:57,680
are Lenovo E10s.

426
00:22:58,160 --> 00:23:01,100
One of them has an asset tag ending in 78412.

427
00:23:02,540 --> 00:23:03,340
That's pretty useful.

428
00:23:03,460 --> 00:23:04,840
I mean, that's really specific information.

429
00:23:04,840 --> 00:23:06,060
If I can call up and say,

430
00:23:06,200 --> 00:23:08,860
I need you to pull out the Lenovo E10

431
00:23:08,860 --> 00:23:12,200
that has asset tag 78412.

432
00:23:14,100 --> 00:23:15,740
Who the hell's on the other part of the phone?

433
00:23:15,840 --> 00:23:16,760
I don't know, but this guy

434
00:23:16,760 --> 00:23:19,460
must be part of our organization, right?

435
00:23:23,300 --> 00:23:24,520
But this one's my favorite.

436
00:23:28,460 --> 00:23:31,560
So, you know, there's a basket with folders inside it,

437
00:23:31,580 --> 00:23:34,060
and the basket has computer passwords

438
00:23:34,060 --> 00:23:36,160
attached to it.

439
00:23:36,220 --> 00:23:38,740
This school literally keeps a basket of passwords.

440
00:23:40,540 --> 00:23:41,720
You may shoot me now.

441
00:23:44,240 --> 00:23:45,380
Well, is it, though?

442
00:23:45,540 --> 00:23:46,380
I mean, I don't know.

443
00:23:46,480 --> 00:23:48,160
A basket of passwords sticking out,

444
00:23:48,200 --> 00:23:50,440
that's like a battle of badness.

445
00:23:50,800 --> 00:23:51,880
How do you use these passwords?

446
00:23:54,420 --> 00:23:55,980
Well, actually, I mean,

447
00:23:56,000 --> 00:23:57,800
I don't want to go down too much the rabbit hole with this guy,

448
00:23:57,900 --> 00:24:00,880
but we knew for a fact that his dog's name

449
00:24:00,880 --> 00:24:02,980
was one of his passwords,

450
00:24:02,980 --> 00:24:04,840
and we were able to find his dog's name

451
00:24:04,840 --> 00:24:05,760
from his Flickr account.

452
00:24:06,740 --> 00:24:07,600
Fair warning, though,

453
00:24:08,120 --> 00:24:10,000
the next ones are probably going to make your brain explode.

454
00:24:10,340 --> 00:24:13,540
I grabbed this off his Flickr account, right?

455
00:24:14,720 --> 00:24:16,420
And this one, right?

456
00:24:16,520 --> 00:24:18,660
So off this one, we can glean that data center 2

457
00:24:18,660 --> 00:24:20,620
has more capability and function than data center 1.

458
00:24:21,840 --> 00:24:22,940
And in case, you know,

459
00:24:22,980 --> 00:24:24,120
you weren't able to get the whole thing,

460
00:24:24,840 --> 00:24:25,580
he's like, you know what?

461
00:24:25,680 --> 00:24:26,720
The first two weren't good enough.

462
00:24:26,740 --> 00:24:28,580
Let me make it so you can see the whole damn thing.

463
00:24:29,240 --> 00:24:31,660
So this is totally stuff you should be putting online, right?

464
00:24:32,980 --> 00:24:33,480
For future...

465
00:24:33,480 --> 00:24:34,400
No, that's not right.

466
00:24:36,900 --> 00:24:37,800
Oh, yes, he did.

467
00:24:40,200 --> 00:24:40,600
Right.

468
00:24:40,800 --> 00:24:41,760
So what do we have here?

469
00:24:41,900 --> 00:24:42,860
A DSL number.

470
00:24:43,860 --> 00:24:46,880
We have the gear name.

471
00:24:47,560 --> 00:24:49,640
We have, yeah, lots of stuff.

472
00:24:49,740 --> 00:24:52,820
And in fact, if we zoom in on the router...

473
00:24:55,960 --> 00:24:56,360
Yeah.

474
00:24:57,720 --> 00:24:59,820
This is like a huge fail sandwich, right?

475
00:24:59,960 --> 00:25:01,820
I mean, with extra fail and less sandwich.

476
00:25:05,780 --> 00:25:07,660
So basically, the wireless SSID,

477
00:25:07,820 --> 00:25:08,500
the network key,

478
00:25:08,640 --> 00:25:10,200
and the tech support number.

479
00:25:10,460 --> 00:25:12,020
Could we do anything bad with that?

480
00:25:12,220 --> 00:25:14,840
You could be the shittiest social engineer on the planet

481
00:25:16,180 --> 00:25:18,500
and still get control over the school, right?

482
00:25:18,660 --> 00:25:22,460
I mean, they don't make silver platters this big.

483
00:25:22,580 --> 00:25:23,740
Let me put it to you that way, right?

484
00:25:24,300 --> 00:25:25,100
But wait, it gets worse.

485
00:25:25,220 --> 00:25:26,320
So that's it with that guy.

486
00:25:26,500 --> 00:25:27,580
I mean, we could go...

487
00:25:27,580 --> 00:25:29,720
That guy is literally a talk unto itself.

488
00:25:29,840 --> 00:25:31,220
Google some of my talks,

489
00:25:31,240 --> 00:25:32,680
and you'll see me kind of roast him.

490
00:25:32,980 --> 00:25:36,540
But he's not alone in posting crazy shit.

491
00:25:37,520 --> 00:25:41,700
This is a French secure data center.

492
00:25:42,720 --> 00:25:44,560
They literally post a video

493
00:25:45,160 --> 00:25:47,980
that is a video tour of their data center

494
00:25:47,980 --> 00:25:49,780
that shows where the cameras are,

495
00:25:50,100 --> 00:25:51,300
where the guards are,

496
00:25:51,580 --> 00:25:53,200
where the car key readers are,

497
00:25:54,240 --> 00:25:55,980
where the exits are,

498
00:25:56,140 --> 00:25:57,520
the entire layout of the building.

499
00:25:57,760 --> 00:25:58,860
But the guards are all yellow.

500
00:26:00,420 --> 00:26:02,260
That's because they're afraid, I think.

501
00:26:02,280 --> 00:26:02,760
I don't know.

502
00:26:02,980 --> 00:26:04,740
Maybe it's a jaundice thing.

503
00:26:06,420 --> 00:26:07,400
Do you think that's something

504
00:26:07,400 --> 00:26:08,680
that you should be putting up online?

505
00:26:09,560 --> 00:26:10,340
Probably not, right?

506
00:26:11,520 --> 00:26:12,380
How about this one?

507
00:26:17,780 --> 00:26:18,840
The stupid, right?

508
00:26:18,920 --> 00:26:20,800
There is no patch for human stupidity.

509
00:26:21,240 --> 00:26:22,300
If you can't see in the back,

510
00:26:22,400 --> 00:26:23,100
push the number...

511
00:26:23,100 --> 00:26:23,780
New door lock.

512
00:26:23,880 --> 00:26:25,460
Push the number two and number four at the same time,

513
00:26:25,480 --> 00:26:26,780
then push number three and press enter.

514
00:26:27,260 --> 00:26:28,140
Thank you very much.

515
00:26:29,980 --> 00:26:32,300
So why doesn't everybody do image intelligence?

516
00:26:32,300 --> 00:26:33,740
Well, great question.

517
00:26:33,840 --> 00:26:34,520
Thank you, Shane.

518
00:26:35,720 --> 00:26:37,420
Because it's very time sensitive, right?

519
00:26:38,260 --> 00:26:40,480
Computers could not have extracted the information,

520
00:26:40,560 --> 00:26:41,680
or at least most of that information,

521
00:26:42,120 --> 00:26:43,460
that we did from those photos,

522
00:26:43,580 --> 00:26:45,360
because a lot of it takes human intuition, right?

523
00:26:45,960 --> 00:26:46,880
At least not yet.

524
00:26:47,800 --> 00:26:49,320
And while we do have good character

525
00:26:49,320 --> 00:26:50,360
and image recognition programs,

526
00:26:50,640 --> 00:26:53,520
they aren't quite as good as we need yet.

527
00:26:53,700 --> 00:26:55,540
And we certainly don't have the AI for it yet.

528
00:26:56,660 --> 00:26:57,380
Like, look at that.

529
00:26:58,740 --> 00:27:01,280
I mean, that would be very hard

530
00:27:01,280 --> 00:27:04,240
for any sort of character recognition system

531
00:27:04,240 --> 00:27:05,380
to translate, right?

532
00:27:05,460 --> 00:27:05,980
And I know me.

533
00:27:06,120 --> 00:27:07,720
Like, I whiteboard all the time,

534
00:27:07,800 --> 00:27:09,440
and I'll come back an hour later and, like,

535
00:27:09,860 --> 00:27:11,340
I don't even know what that word is,

536
00:27:11,380 --> 00:27:12,340
and I wrote it, right?

537
00:27:12,480 --> 00:27:14,320
If I don't know what my handwriting is,

538
00:27:14,480 --> 00:27:16,520
how am I supposed to expect a machine to know what it is?

539
00:27:17,920 --> 00:27:19,680
So, you know, there are some issues.

540
00:27:23,560 --> 00:27:24,880
There is a lot of research, though,

541
00:27:24,920 --> 00:27:27,560
that's going on in scene text detection and recognition.

542
00:27:28,300 --> 00:27:30,180
A lot of it's being done in China.

543
00:27:30,180 --> 00:27:31,240
I don't know why I keep saying ah.

544
00:27:31,400 --> 00:27:32,140
Sorry about that.

545
00:27:32,200 --> 00:27:34,300
It's just a stupid thing.

546
00:27:36,380 --> 00:27:37,080
Don't do it!

547
00:27:39,260 --> 00:27:42,740
The Chinese are doing a ton of research into this stuff.

548
00:27:44,640 --> 00:27:45,940
One approach that they suggested

549
00:27:47,180 --> 00:27:49,000
that was initially kind of what they were doing

550
00:27:49,000 --> 00:27:50,540
is they were doing a sliding scale per character.

551
00:27:50,720 --> 00:27:51,700
So they take each character

552
00:27:51,700 --> 00:27:55,700
and then match what the mathematical probability

553
00:27:55,700 --> 00:27:57,120
and the sentence structure should be

554
00:27:57,120 --> 00:27:58,140
to the character beside it.

555
00:27:58,220 --> 00:27:59,980
But that's really not a good way to do it.

556
00:28:00,180 --> 00:28:00,320
It's not efficient.

557
00:28:00,500 --> 00:28:03,180
You need a big list of every possible characters

558
00:28:03,180 --> 00:28:05,420
and for every word, a sequence.

559
00:28:05,600 --> 00:28:06,760
I mean, it's just unmanageable.

560
00:28:07,420 --> 00:28:09,120
So what they started doing now

561
00:28:09,120 --> 00:28:13,420
is they do what they call component-based methods,

562
00:28:13,580 --> 00:28:15,900
and that's where they'll do stuff like color clustering,

563
00:28:16,460 --> 00:28:18,320
removal of background, so they start seeing

564
00:28:18,320 --> 00:28:19,740
if this is blank, just cut it down.

565
00:28:19,840 --> 00:28:21,200
So they start trimming stuff down

566
00:28:21,200 --> 00:28:23,840
to the smallest possible readable chunks that they use.

567
00:28:23,960 --> 00:28:25,660
And then they filter out non-text elements

568
00:28:27,280 --> 00:28:29,980
basically according to a customized configuration.

569
00:28:30,180 --> 00:28:33,420
And there's a really good paper out there

570
00:28:33,420 --> 00:28:34,280
that you can see.

571
00:28:34,400 --> 00:28:36,560
It's by these guys from, I think it's Beijing University.

572
00:28:37,360 --> 00:28:39,180
Bai Zhu, Yao, and Bai.

573
00:28:40,140 --> 00:28:41,200
But you can see here,

574
00:28:41,780 --> 00:28:44,680
these are all being read very clearly, right?

575
00:28:44,740 --> 00:28:45,460
No problem there.

576
00:28:46,340 --> 00:28:49,620
But here, we see it actually misses stuff.

577
00:28:50,900 --> 00:28:55,900
And it's very hard for us to do image and text retrieval

578
00:28:55,900 --> 00:28:57,560
because, especially in the real world,

579
00:28:57,600 --> 00:28:59,700
you'll see things like different colored backgrounds,

580
00:28:59,700 --> 00:29:01,540
you'll see different fonts and size,

581
00:29:02,100 --> 00:29:05,140
unknown fonts, different colors, shading.

582
00:29:05,640 --> 00:29:08,000
I mean, there's a ton of things that kind of boggle it up.

583
00:29:10,760 --> 00:29:12,760
The good news is researchers really think

584
00:29:12,760 --> 00:29:14,900
that big data and deep learning will help tremendously.

585
00:29:15,120 --> 00:29:17,940
And the consensus is within the next 10 years,

586
00:29:18,080 --> 00:29:20,360
we're probably going to have this problem solved.

587
00:29:21,940 --> 00:29:23,780
If you're interested in getting into text recognition,

588
00:29:23,960 --> 00:29:26,420
I would really recommend that you follow this.

589
00:29:26,960 --> 00:29:29,020
The account name is called Carlos Tao,

590
00:29:29,020 --> 00:29:32,800
which is probably the most weird Chinese name ever.

591
00:29:34,460 --> 00:29:36,420
Peking University, awesome text,

592
00:29:36,560 --> 00:29:38,580
awesome scene text recognition is the GitHub repo.

593
00:29:38,840 --> 00:29:39,800
And I'll make these slides available

594
00:29:39,800 --> 00:29:41,500
so you can just grab these things.

595
00:29:43,400 --> 00:29:45,320
So what is the future of image intelligence?

596
00:29:45,740 --> 00:29:47,680
Well, we're going to be able to unblur photos.

597
00:29:48,120 --> 00:29:49,780
That's definitely something that's coming down the pike.

598
00:29:49,860 --> 00:29:51,720
In fact, there are cameras now out there, right?

599
00:29:51,780 --> 00:29:54,020
You take the picture, ah, it's kind of screwed up,

600
00:29:54,040 --> 00:29:55,440
and you can roll it back.

601
00:29:56,480 --> 00:29:58,220
We're going to start seeing super high resolution.

602
00:29:58,220 --> 00:29:59,920
We're not going to have to be gleaning

603
00:29:59,920 --> 00:30:02,120
and putting in high pass filters and that sort of thing.

604
00:30:02,400 --> 00:30:04,060
You know, when you get to 4K images,

605
00:30:04,260 --> 00:30:06,220
you can really scroll up stuff from afar

606
00:30:06,220 --> 00:30:08,260
and see a lot of patterns quickly.

607
00:30:08,600 --> 00:30:10,500
We're going to be able to detect and extract text.

608
00:30:10,860 --> 00:30:12,820
We're going to have facial recognition down.

609
00:30:13,180 --> 00:30:15,000
Location recognition is going to be a big thing,

610
00:30:15,060 --> 00:30:17,280
where basically you take a shot of something

611
00:30:17,280 --> 00:30:18,980
and just by the background,

612
00:30:19,420 --> 00:30:20,560
they'll be able to start saying,

613
00:30:21,140 --> 00:30:23,460
at least if they can't locate where you are,

614
00:30:23,580 --> 00:30:25,180
we can start locating where you're not,

615
00:30:25,680 --> 00:30:27,620
which is just as valuable in many cases.

616
00:30:31,300 --> 00:30:32,260
Um, yeah.

617
00:30:32,380 --> 00:30:33,500
And advancements in cameras

618
00:30:33,500 --> 00:30:35,300
are already making image intelligence easier.

619
00:30:36,300 --> 00:30:38,320
We're already able to script some things

620
00:30:38,320 --> 00:30:41,400
where we can pull out things like names from name tags.

621
00:30:41,860 --> 00:30:43,280
Right? That's something we can do.

622
00:30:46,020 --> 00:30:47,640
So Amazon's already in on this.

623
00:30:47,780 --> 00:30:49,840
They have a product called Amazon Recognition.

624
00:30:49,880 --> 00:30:52,520
It's a deep learning based image recognition system.

625
00:30:53,180 --> 00:30:56,580
You can identify and detect objects, scenes, faces.

626
00:30:56,580 --> 00:30:57,960
You can recognize celebrities.

627
00:30:58,140 --> 00:31:02,240
It can identify inappropriate content, so i.e. nudes.

628
00:31:02,860 --> 00:31:04,780
They are literally deconstructing images

629
00:31:04,780 --> 00:31:05,860
into their base elements.

630
00:31:07,580 --> 00:31:09,640
So this is part of their marketing.

631
00:31:10,280 --> 00:31:14,780
They can do object detection, object and scene detection.

632
00:31:17,080 --> 00:31:19,380
They can do face detection and facial analysis.

633
00:31:19,440 --> 00:31:21,680
Are you happy? Are you sad? Are your eyes open?

634
00:31:24,280 --> 00:31:25,080
Face comparison.

635
00:31:28,420 --> 00:31:30,060
Even do face search in a crowd.

636
00:31:30,420 --> 00:31:32,780
Right? All these technologies should give you

637
00:31:32,780 --> 00:31:34,700
a really good glance of where we're heading really quickly,

638
00:31:34,780 --> 00:31:35,540
what's coming down the road.

639
00:31:35,640 --> 00:31:38,680
And in fact, C-SPAN is already using this technology

640
00:31:38,680 --> 00:31:41,880
to automatically put names to speakers.

641
00:31:42,320 --> 00:31:45,260
So that they've saved thousands and thousands of hours

642
00:31:45,260 --> 00:31:46,040
and a lot of money,

643
00:31:46,100 --> 00:31:47,320
because now they don't have to do it by hand.

644
00:31:49,980 --> 00:31:51,200
So there is some good news.

645
00:31:51,680 --> 00:31:52,260
For recon.

646
00:31:52,380 --> 00:31:53,120
And there's some bad news.

647
00:31:53,220 --> 00:31:54,360
We'll go over the first, the good news.

648
00:31:54,480 --> 00:31:56,300
The good news is people are creatures of habit.

649
00:31:56,440 --> 00:31:58,860
So they're always going to be using the same username over and over.

650
00:31:59,000 --> 00:32:00,920
We're going to be able to track them all over the internet.

651
00:32:01,100 --> 00:32:01,820
Right? Stuff like that.

652
00:32:02,680 --> 00:32:04,300
We're going to be able to do things like

653
00:32:04,720 --> 00:32:06,320
have big data available to us.

654
00:32:06,360 --> 00:32:08,120
So let's say somebody posts some anonymous

655
00:32:09,040 --> 00:32:11,960
post about how it's raining like hell outside.

656
00:32:12,200 --> 00:32:15,700
And we'll be able to pick up every weather station around the world

657
00:32:15,700 --> 00:32:18,240
real-time data and go, where is it raining right now?

658
00:32:19,420 --> 00:32:20,520
Start doing stuff like that.

659
00:32:23,740 --> 00:32:27,420
So I think the big future of open source intelligence

660
00:32:27,420 --> 00:32:29,440
is going to be crowd-sourced open source intelligence.

661
00:32:29,560 --> 00:32:30,860
And we're already starting to see that happen.

662
00:32:31,620 --> 00:32:33,180
We've had some, you know,

663
00:32:33,200 --> 00:32:34,640
it's not like social media is going to go anywhere.

664
00:32:34,860 --> 00:32:36,660
Because we, and anybody that does OSINT,

665
00:32:36,780 --> 00:32:38,840
you know, we live on social media, right?

666
00:32:38,860 --> 00:32:39,480
It's what feeds us.

667
00:32:39,840 --> 00:32:41,120
But in order for it to survive,

668
00:32:41,220 --> 00:32:42,720
there has to be one of two business models.

669
00:32:42,880 --> 00:32:43,860
You either pay for it,

670
00:32:44,600 --> 00:32:47,940
or you let us mine your data even deeper than we are now.

671
00:32:49,240 --> 00:32:50,940
And this is going to become a real issue,

672
00:32:50,940 --> 00:32:53,420
because most social media companies are not making money.

673
00:32:53,840 --> 00:32:56,700
I mean, most Silicon Valley companies aren't making money,

674
00:32:56,800 --> 00:32:57,900
but put that aside, right?

675
00:32:59,180 --> 00:33:01,920
So most users will sadly go with the advertising.

676
00:33:02,120 --> 00:33:06,000
They rather sell all their privacy, all their data,

677
00:33:06,100 --> 00:33:08,980
instead of spending ten bucks a month to protect that,

678
00:33:09,140 --> 00:33:10,820
which is kind of a sad state of affairs.

679
00:33:11,760 --> 00:33:14,160
So all of a sudden, if you're taking specific supplements,

680
00:33:14,300 --> 00:33:15,420
they can figure out what's going on, right?

681
00:33:15,520 --> 00:33:17,980
You're taking some sort of, you know,

682
00:33:17,980 --> 00:33:19,900
supplement because you think you're pregnant.

683
00:33:20,940 --> 00:33:22,460
They can do that analytics, right?

684
00:33:22,580 --> 00:33:24,480
Or if you're trying to boost your testosterone,

685
00:33:24,720 --> 00:33:26,060
like I say, hopefully not at the same time,

686
00:33:26,140 --> 00:33:27,180
they can detect that.

687
00:33:27,220 --> 00:33:28,080
They can say, you know what?

688
00:33:28,160 --> 00:33:29,400
I think this person has Cushing's.

689
00:33:30,300 --> 00:33:31,780
They're already starting to do this sort of thing.

690
00:33:34,000 --> 00:33:35,580
We've already started to see some spin-offs

691
00:33:35,580 --> 00:33:38,240
of Reddit and Facebook that were community-driven.

692
00:33:38,360 --> 00:33:39,620
Some were more successful than others.

693
00:33:39,700 --> 00:33:40,300
Some are still going.

694
00:33:41,220 --> 00:33:43,220
None, obviously, nearly as successful as the original.

695
00:33:43,500 --> 00:33:45,340
We see very huge projects

696
00:33:45,340 --> 00:33:47,020
where they're crowd-sourcing Wi-Fi maps.

697
00:33:47,220 --> 00:33:49,560
We're seeing crowd-sourced phone books and contact lists.

698
00:33:49,560 --> 00:33:51,440
And these will continue to grow,

699
00:33:51,580 --> 00:33:52,820
most likely, you know,

700
00:33:52,820 --> 00:33:55,620
either as a privacy-driven offshoot

701
00:33:55,620 --> 00:33:58,040
or as a pay-as-you-go privacy-type site.

702
00:33:58,160 --> 00:33:59,160
People that say, you know what?

703
00:33:59,200 --> 00:34:00,940
I don't want my data trafficked anymore.

704
00:34:03,700 --> 00:34:06,060
Here's an example of crowd-sourced OSINT that's out.

705
00:34:06,120 --> 00:34:08,180
It's called Ushahidi.

706
00:34:08,520 --> 00:34:10,540
And frankly, I hadn't heard of these guys

707
00:34:10,540 --> 00:34:11,980
until earlier in the week

708
00:34:11,980 --> 00:34:14,340
when their executive director

709
00:34:14,340 --> 00:34:15,860
got fired for sexual harassment.

710
00:34:16,360 --> 00:34:18,520
I mean, that showed up in my feed.

711
00:34:18,520 --> 00:34:19,500
It was, oh, okay.

712
00:34:19,700 --> 00:34:20,740
Who are these guys?

713
00:34:20,860 --> 00:34:21,940
And you start digging into it.

714
00:34:22,040 --> 00:34:23,320
These guys are actually doing

715
00:34:23,320 --> 00:34:25,900
open-source intelligence tracking in war zones.

716
00:34:26,140 --> 00:34:30,420
So they're tracking human rights activities

717
00:34:31,000 --> 00:34:33,020
that you can report anonymously.

718
00:34:34,160 --> 00:34:37,500
Now, anyone see an opportunity here

719
00:34:37,500 --> 00:34:38,260
for an attacker, though?

720
00:34:39,320 --> 00:34:39,760
Right?

721
00:34:40,020 --> 00:34:41,320
You put up your own site

722
00:34:41,320 --> 00:34:44,000
where people can report stuff anonymously.

723
00:34:45,240 --> 00:34:47,720
We put a lot of trust into these vendors,

724
00:34:47,720 --> 00:34:49,260
but we don't know who these vendors are.

725
00:34:50,220 --> 00:34:52,280
This is a real problem with open-source intelligence.

726
00:34:52,400 --> 00:34:54,400
It's open, but who's putting what out there?

727
00:34:57,780 --> 00:35:01,780
Crowd-sourced geo-terrain and satellite imaging.

728
00:35:01,940 --> 00:35:03,580
That's something that we're definitely starting to see.

729
00:35:04,180 --> 00:35:05,980
We're already starting to see things like TomNod,

730
00:35:06,100 --> 00:35:13,860
which is a crowd-sourced satellite intelligence analysis program.

731
00:35:14,960 --> 00:35:16,460
Bellingcat, which is terrestrial.

732
00:35:17,080 --> 00:35:18,540
I don't know if you guys have seen this,

733
00:35:18,580 --> 00:35:19,800
but this is journalists around the world

734
00:35:19,800 --> 00:35:22,540
doing some really amazing stuff with Bellingcat.

735
00:35:22,780 --> 00:35:24,660
And so, especially in the Ukrainian war,

736
00:35:24,780 --> 00:35:26,060
they've been able to really identify,

737
00:35:26,300 --> 00:35:26,920
hey, guess what?

738
00:35:27,440 --> 00:35:31,000
This piece of armament was in this location at this time.

739
00:35:31,200 --> 00:35:33,060
And they can even say it was in this meadow.

740
00:35:34,720 --> 00:35:35,900
Really cool stuff.

741
00:35:36,000 --> 00:35:38,000
I would seriously recommend everybody check out Bellingcat.

742
00:35:38,760 --> 00:35:40,460
And then there was something called satellite sentinel,

743
00:35:41,080 --> 00:35:41,960
which was George Clooney.

744
00:35:42,080 --> 00:35:43,180
It was a very temporary thing.

745
00:35:43,260 --> 00:35:44,560
It was for the war in Darfur.

746
00:35:45,440 --> 00:35:46,920
But very soon,

747
00:35:46,980 --> 00:35:49,180
you might even be able to launch your own satellites.

748
00:35:49,780 --> 00:35:51,900
Facebook.com slash space boffins.

749
00:35:51,980 --> 00:35:54,560
These guys are talking about mini satellite swarms.

750
00:35:55,140 --> 00:35:56,220
Nano-satellites.

751
00:35:56,760 --> 00:35:59,800
So it's certainly not beyond the realm of possibility

752
00:35:59,800 --> 00:36:01,740
that crowd-funding a civilian satellite project.

753
00:36:02,220 --> 00:36:03,460
I mean, that's more than feasible.

754
00:36:03,640 --> 00:36:06,160
Especially as lens technology comes down in price

755
00:36:06,160 --> 00:36:09,260
and increases in strength and power.

756
00:36:09,520 --> 00:36:12,540
Very soon, we're going to have civilian satellites.

757
00:36:12,840 --> 00:36:13,680
We'll be able to track

758
00:36:13,680 --> 00:36:15,100
what the government's doing.

759
00:36:15,420 --> 00:36:16,660
I don't think they'll like that.

760
00:36:16,800 --> 00:36:17,980
That's my guess.

761
00:36:19,900 --> 00:36:21,540
Crowd-sourced public camera database.

762
00:36:21,700 --> 00:36:23,720
That's something that I want to pitch at Chaos,

763
00:36:23,880 --> 00:36:24,540
and I still might.

764
00:36:25,220 --> 00:36:27,640
I want to do my own thing where we basically take

765
00:36:28,120 --> 00:36:29,940
Raspberry Pis and set up our own network,

766
00:36:30,080 --> 00:36:31,540
where we capture license plates,

767
00:36:31,640 --> 00:36:32,580
just like the police do,

768
00:36:32,700 --> 00:36:34,480
but make it totally open source

769
00:36:34,480 --> 00:36:36,640
so everybody can see where the politicians are going,

770
00:36:36,840 --> 00:36:38,160
where the police are going,

771
00:36:38,300 --> 00:36:39,420
where the people that want to tell us

772
00:36:39,420 --> 00:36:42,360
if we've got nothing to hide are going.

773
00:36:44,400 --> 00:36:46,340
If I die, it was probably because of that, though.

774
00:36:48,300 --> 00:36:49,260
The other question is,

775
00:36:49,380 --> 00:36:50,820
license plate, you know,

776
00:36:50,820 --> 00:36:52,780
I don't know if you saw the thing on Facebook this week,

777
00:36:52,860 --> 00:36:54,180
you know, the new flying car, right?

778
00:36:54,200 --> 00:36:56,180
Are we actually going to have license plates on flying cars?

779
00:36:56,420 --> 00:36:57,620
So, I don't know.

780
00:36:57,680 --> 00:36:58,560
It might not be worth the investment.

781
00:37:00,360 --> 00:37:01,720
Future of recon, though, bad news.

782
00:37:02,140 --> 00:37:03,800
Social media's going to definitely come under pressure

783
00:37:03,800 --> 00:37:06,780
to address hate speech, defamation, terror, porn,

784
00:37:06,900 --> 00:37:07,620
and that sort of stuff.

785
00:37:07,740 --> 00:37:10,180
Not terror, terror, comma, revenge porn.

786
00:37:11,460 --> 00:37:12,700
Maybe terror, revenge porn.

787
00:37:12,760 --> 00:37:13,120
I don't know.

788
00:37:13,680 --> 00:37:14,420
I've done some crazy shit.

789
00:37:16,860 --> 00:37:18,360
But they've already got fines,

790
00:37:18,620 --> 00:37:21,720
so Germany just gave them a massive,

791
00:37:21,880 --> 00:37:22,400
well, not massive,

792
00:37:22,460 --> 00:37:24,700
but five to $50 million euro fine

793
00:37:24,700 --> 00:37:25,800
is what they're proposing now

794
00:37:25,800 --> 00:37:27,280
if material is not taken down

795
00:37:27,280 --> 00:37:29,660
within 24 hours of a complaint.

796
00:37:30,020 --> 00:37:31,260
So, guess what's going to happen?

797
00:37:31,380 --> 00:37:33,260
Guess what the default action is going to be

798
00:37:33,260 --> 00:37:33,820
when someone says,

799
00:37:33,900 --> 00:37:34,740
yeah, this offends me,

800
00:37:34,760 --> 00:37:35,940
or this is bad data.

801
00:37:36,240 --> 00:37:37,780
Do you think they're going to wait 24 hours

802
00:37:37,780 --> 00:37:40,300
for some minimum, you know,

803
00:37:40,340 --> 00:37:42,360
$2 above minimum wage person to check it out?

804
00:37:42,420 --> 00:37:42,580
No.

805
00:37:42,580 --> 00:37:45,020
That data's going to disappear like that.

806
00:37:45,280 --> 00:37:45,760
Right?

807
00:37:45,940 --> 00:37:47,480
That's what the attack's going to be, obviously.

808
00:37:49,360 --> 00:37:50,880
So it's going to be really easy for us

809
00:37:50,880 --> 00:37:53,560
to suppress speech and data.

810
00:37:54,720 --> 00:37:58,280
So France has this thing called the CNIL,

811
00:37:58,520 --> 00:38:00,080
the Data Protection Authority.

812
00:38:00,400 --> 00:38:02,280
They're saying that Facebook does not have

813
00:38:02,280 --> 00:38:03,700
a legal basis under EU law

814
00:38:03,700 --> 00:38:06,340
to combine all the information it has on account holders

815
00:38:06,340 --> 00:38:07,800
to display targeted advertising,

816
00:38:08,100 --> 00:38:10,520
i.e., their frickin' business model.

817
00:38:11,080 --> 00:38:11,600
Right?

818
00:38:12,120 --> 00:38:13,920
That's an existential threat to the company.

819
00:38:15,100 --> 00:38:18,200
It also finds that Facebook engages in unlawful tracking

820
00:38:18,200 --> 00:38:20,140
via data cookies of Internet users.

821
00:38:20,540 --> 00:38:22,000
They continue to act in noncompliance.

822
00:38:22,040 --> 00:38:23,100
The maximum fine for next year

823
00:38:23,100 --> 00:38:24,420
will be 4% of global turnover,

824
00:38:24,540 --> 00:38:26,400
or $20 million, whichever is greater.

825
00:38:26,560 --> 00:38:27,800
That sounds horrible,

826
00:38:28,360 --> 00:38:29,540
until you realize they made

827
00:38:29,540 --> 00:38:31,280
$2.5 billion last quarter, right?

828
00:38:31,380 --> 00:38:33,200
So it's a drop in the bucket.

829
00:38:33,280 --> 00:38:34,600
It's a price of doing business.

830
00:38:35,700 --> 00:38:37,740
But not everybody's making money, right?

831
00:38:38,980 --> 00:38:40,900
Here's some other bad news for the future recon.

832
00:38:40,900 --> 00:38:42,040
I'm sorry, I'm going to be, like,

833
00:38:42,060 --> 00:38:43,220
two minutes over time.

834
00:38:44,420 --> 00:38:46,900
Our old problem with recon was

835
00:38:46,900 --> 00:38:48,920
we were designed to try and find

836
00:38:48,920 --> 00:38:50,340
needles in haystacks, right?

837
00:38:51,040 --> 00:38:52,300
Well, now we've got a bigger problem.

838
00:38:52,480 --> 00:38:53,840
Now we actually have to find

839
00:38:54,660 --> 00:38:56,680
which needles are actually legit needles.

840
00:38:57,080 --> 00:38:58,720
We have fake news.

841
00:38:59,560 --> 00:39:00,960
We have data poisoning,

842
00:39:01,100 --> 00:39:02,060
deliberate data poisoning.

843
00:39:02,420 --> 00:39:04,580
So now every time we find a piece of data,

844
00:39:04,660 --> 00:39:05,600
we actually need to validate

845
00:39:05,600 --> 00:39:07,160
that that piece of data is legitimate.

846
00:39:08,320 --> 00:39:10,040
Twitter, I don't know if you saw this study,

847
00:39:10,040 --> 00:39:13,440
they showed that 9 to 15% of users are bots.

848
00:39:14,220 --> 00:39:14,940
They're fake.

849
00:39:15,120 --> 00:39:15,820
Fake news.

850
00:39:16,120 --> 00:39:17,340
Stuff that we can't trust.

851
00:39:18,400 --> 00:39:20,260
There's a site called botometer.com,

852
00:39:20,360 --> 00:39:21,860
or the botometer tool.

853
00:39:21,920 --> 00:39:22,440
You should check it out.

854
00:39:22,620 --> 00:39:23,660
And in data poisoning,

855
00:39:23,800 --> 00:39:24,620
we see this all the time,

856
00:39:24,680 --> 00:39:27,520
offensive and defensive poisoning of data.

857
00:39:28,980 --> 00:39:31,140
So we could use that for really good and bad.

858
00:39:31,480 --> 00:39:33,520
We can jam up social media with fake accounts.

859
00:39:34,160 --> 00:39:35,480
Content for keywords we know

860
00:39:35,480 --> 00:39:37,180
that oppressive governments are mining,

861
00:39:37,320 --> 00:39:39,320
we can just put that in every frickin' tweet

862
00:39:39,320 --> 00:39:41,000
and over, you know, drown the analysts.

863
00:39:41,500 --> 00:39:43,000
As anti-bot detection rises,

864
00:39:43,140 --> 00:39:44,900
so does the barrier to entry, right?

865
00:39:45,040 --> 00:39:47,040
So fake accounts are really easy to prevent.

866
00:39:47,180 --> 00:39:49,300
You need to tie it to an actual phone or credit card.

867
00:39:49,540 --> 00:39:51,100
But companies don't do this

868
00:39:51,100 --> 00:39:52,760
because it would impact their earnings.

869
00:39:53,680 --> 00:39:56,020
So the government is moving towards requiring this.

870
00:39:56,120 --> 00:39:56,880
And as that happens,

871
00:39:57,100 --> 00:40:00,040
we will start to see a lot of this go away.

872
00:40:01,220 --> 00:40:02,400
There's a thing out there

873
00:40:02,400 --> 00:40:04,900
called the Crowdsourced Intelligence Agency.

874
00:40:05,220 --> 00:40:06,100
It's really neat.

875
00:40:06,300 --> 00:40:07,800
What these guys do is they actually,

876
00:40:07,800 --> 00:40:09,640
if you, you can put in a tweet,

877
00:40:09,800 --> 00:40:11,600
and it will rank the probability

878
00:40:11,600 --> 00:40:13,500
and the highness of it being flagged

879
00:40:13,500 --> 00:40:15,280
by government filters as being offensive

880
00:40:15,280 --> 00:40:17,240
or needing real, you know,

881
00:40:17,240 --> 00:40:18,400
law enforcement follow-up.

882
00:40:20,160 --> 00:40:21,920
So let's flip that OSN tool

883
00:40:22,640 --> 00:40:23,500
that was designed for good

884
00:40:23,500 --> 00:40:24,380
and flip it into bad.

885
00:40:24,580 --> 00:40:25,860
So let's find out that our target

886
00:40:25,860 --> 00:40:26,800
is traveling in a few months.

887
00:40:26,940 --> 00:40:27,520
So what do we do?

888
00:40:27,780 --> 00:40:29,600
We create an account for someone that exists.

889
00:40:29,840 --> 00:40:31,760
We have a bunch of sock puppets accounts

890
00:40:32,240 --> 00:40:33,280
follow that target.

891
00:40:34,280 --> 00:40:35,740
That someone that exists is him.

892
00:40:35,840 --> 00:40:37,140
We begin to interact with him.

893
00:40:37,140 --> 00:40:38,180
Now we set up a Twitter account

894
00:40:38,920 --> 00:40:39,820
impersonating that person.

895
00:40:40,120 --> 00:40:42,000
We fill it with content from his social media.

896
00:40:42,080 --> 00:40:44,500
So we basically clone this guy on social media,

897
00:40:44,640 --> 00:40:46,240
take stuff from his Facebook account,

898
00:40:46,340 --> 00:40:47,060
whatever, post it.

899
00:40:47,160 --> 00:40:49,080
So now it's his account as well.

900
00:40:49,260 --> 00:40:51,760
It's his clone account that he doesn't know about.

901
00:40:51,980 --> 00:40:53,720
Over time we start feeding the puppets

902
00:40:53,720 --> 00:40:56,020
following our impersonation account as well.

903
00:40:56,360 --> 00:40:58,080
Care and feeding of these bots is important.

904
00:40:58,300 --> 00:41:00,240
They need to be legitimate accounts, not mindless.

905
00:41:00,440 --> 00:41:02,400
We tweet the occasional anti-government

906
00:41:02,400 --> 00:41:03,260
but nothing too bad.

907
00:41:03,820 --> 00:41:06,040
Now we know the guy is about to hop on an airplane

908
00:41:06,040 --> 00:41:07,320
and as he's at the terminal,

909
00:41:07,420 --> 00:41:08,460
we type in something like,

910
00:41:09,360 --> 00:41:11,360
today is the day I blow up an airliner.

911
00:41:11,980 --> 00:41:13,040
He's on the air.

912
00:41:14,060 --> 00:41:14,460
Right?

913
00:41:15,720 --> 00:41:17,800
All those filters are going to find him.

914
00:41:17,820 --> 00:41:19,860
The way we find out the tweet to use,

915
00:41:20,040 --> 00:41:22,240
we just use that CS,

916
00:41:22,380 --> 00:41:25,620
the open source intelligence bot

917
00:41:25,620 --> 00:41:30,020
to tell us what the ideal tweet is to send out.

918
00:41:31,160 --> 00:41:32,820
Like I said, data poisoning is going to increase.

919
00:41:32,900 --> 00:41:33,440
We're going to see that.

920
00:41:33,600 --> 00:41:35,700
It's very important that you as a reconnaissance analyst

921
00:41:36,040 --> 00:41:37,400
always seek the validity of the source,

922
00:41:37,580 --> 00:41:39,140
always question who your source is

923
00:41:39,140 --> 00:41:41,660
and what their intent on releasing that information is.

924
00:41:43,020 --> 00:41:45,920
Some dark and vice data is going to lose its value right now.

925
00:41:46,080 --> 00:41:49,540
You can blackmail people by geolocating them on Grindr

926
00:41:49,540 --> 00:41:51,520
or gay ads.

927
00:41:52,460 --> 00:41:53,640
Nobody's going to care in a while.

928
00:41:54,280 --> 00:41:55,280
Sorry guys, I'm coming.

929
00:41:57,180 --> 00:41:59,260
A couple other things that I think are really cool

930
00:41:59,260 --> 00:41:59,920
that you should check out.

931
00:42:00,120 --> 00:42:01,160
Something called stylometry.

932
00:42:01,480 --> 00:42:03,640
It assesses sentence structure and writing style

933
00:42:03,640 --> 00:42:04,600
to identify users.

934
00:42:04,600 --> 00:42:08,920
If someone's typing stuff and you don't know who they are,

935
00:42:09,220 --> 00:42:11,960
you can actually start to find commonalities

936
00:42:11,960 --> 00:42:13,520
between different posts on different sites.

937
00:42:14,620 --> 00:42:16,320
You're definitely going to see increases

938
00:42:16,320 --> 00:42:18,260
in both stylometry techniques and countermeasures.

939
00:42:18,420 --> 00:42:20,040
There is a countermeasure called Anonymouth.

940
00:42:21,560 --> 00:42:23,240
There's also an R library that lets you

941
00:42:23,240 --> 00:42:26,600
rule your own stylometry lab at Google.

942
00:42:27,300 --> 00:42:28,560
Like I said, I'm going to make these all available.

943
00:42:28,880 --> 00:42:30,300
Then there's a researcher, Kim Jouts,

944
00:42:30,500 --> 00:42:32,020
who also has a blog that you should check out.

945
00:42:33,500 --> 00:42:35,460
The good news for us as pen testers,

946
00:42:35,660 --> 00:42:37,460
people are always going to continue to leak information.

947
00:42:37,840 --> 00:42:38,760
They're going to be looking for jobs,

948
00:42:38,980 --> 00:42:40,500
they're going to be government records,

949
00:42:40,960 --> 00:42:43,820
social media, GPS, sex and dating.

950
00:42:43,980 --> 00:42:46,660
People are going to do anything to get their groove on.

951
00:42:46,920 --> 00:42:49,000
It is inevitable that most, if not all,

952
00:42:49,100 --> 00:42:50,680
of the libraries that we've talked about before

953
00:42:50,680 --> 00:42:52,080
are going to be released to the public

954
00:42:52,080 --> 00:42:54,540
or will at least develop our own versions of them,

955
00:42:54,580 --> 00:42:55,460
and they'll be open source.

956
00:42:55,720 --> 00:42:58,640
Just imagine the power that's going to give the individual.

957
00:42:59,520 --> 00:43:01,160
But the really bad news is,

958
00:43:02,020 --> 00:43:03,900
pretty much everyone's going to have access to this data.

959
00:43:04,080 --> 00:43:06,080
And the really bad news to all of us in this room

960
00:43:06,080 --> 00:43:08,100
is that as these technologies improve,

961
00:43:08,300 --> 00:43:09,060
along with AI,

962
00:43:09,400 --> 00:43:11,160
and as the TAC tools get more automated,

963
00:43:11,280 --> 00:43:14,900
while perhaps edge case stuff requires a bit more digging,

964
00:43:16,000 --> 00:43:17,940
there's not going to be very much that AI can't do.

965
00:43:18,360 --> 00:43:20,040
We're not going to be employed to do the digging.

966
00:43:20,560 --> 00:43:21,920
We're going to have machines do it.

967
00:43:22,720 --> 00:43:24,460
Pen testing is not going to be a job.

968
00:43:24,820 --> 00:43:25,860
It's not going to be a career.

969
00:43:26,180 --> 00:43:27,000
I hate to say it.

970
00:43:28,940 --> 00:43:30,060
Who has the most power?

971
00:43:30,280 --> 00:43:30,720
The government.

972
00:43:30,720 --> 00:43:32,260
The government works for us.

973
00:43:32,420 --> 00:43:34,500
There are some big decisions for us to make.

974
00:43:34,700 --> 00:43:36,720
Let's make the government make the right decision.

975
00:43:37,320 --> 00:43:39,700
We as hackers have competing interests.

976
00:43:40,060 --> 00:43:41,720
We should be the guardians of data.

977
00:43:42,460 --> 00:43:44,380
I know we're paid to attack that data,

978
00:43:44,520 --> 00:43:47,000
but we need to have an ethical and moral discussion.

979
00:43:47,680 --> 00:43:49,440
What side of this fence are we on?

980
00:43:49,600 --> 00:43:52,240
Are we aiding and abetting just for a paycheck?

981
00:43:52,940 --> 00:43:54,400
Is that who we really want to be?

982
00:43:56,860 --> 00:43:57,460
That's it.

983
00:43:57,760 --> 00:44:00,140
You can always call me or email me.

984
00:44:00,140 --> 00:44:01,600
Shane at tacticalintelligence.org.

985
00:44:01,700 --> 00:44:02,760
You can get me on Twitter.

986
00:44:02,880 --> 00:44:05,460
Tactical Intel is my tech account.

987
00:44:05,700 --> 00:44:07,180
Planet Shane is my comedy account.

988
00:44:08,420 --> 00:44:09,740
Thank you very much for coming.

989
00:44:09,840 --> 00:44:11,160
Thank you very much for inviting me.

990
00:44:11,320 --> 00:44:12,100
It was a big honor.

991
00:44:12,220 --> 00:44:12,840
Thank you so much.

992
00:44:17,360 --> 00:44:17,760
Sorry.

993
00:44:18,060 --> 00:44:19,120
Sorry for running over now.