1 00:00:00,000 --> 00:00:02,140 Good afternoon. It's nice to be here. 2 00:00:03,340 --> 00:00:04,460 How's it going in DEF CON so far? 3 00:00:04,880 --> 00:00:05,860 You guys enjoying it? 4 00:00:06,420 --> 00:00:06,820 Awesome! 5 00:00:07,940 --> 00:00:09,340 So, yeah, so when 6 00:00:09,340 --> 00:00:11,760 when we're thinking about the RECON 7 00:00:11,760 --> 00:00:13,300 I used to do a lot of 8 00:00:13,300 --> 00:00:14,560 open source intelligence 9 00:00:16,180 --> 00:00:17,680 so I thought, okay, let's 10 00:00:17,680 --> 00:00:18,700 take another approach. 11 00:00:20,180 --> 00:00:21,880 Of course we will go to the social networks 12 00:00:21,880 --> 00:00:23,740 and all that stuff, but let's try to get 13 00:00:23,740 --> 00:00:25,520 information from source code. 14 00:00:25,760 --> 00:00:28,200 And that's the idea of this talk 15 00:00:28,200 --> 00:00:29,020 to give you some tips. 16 00:00:30,000 --> 00:00:31,740 So that will be the talk. 17 00:00:31,920 --> 00:00:32,720 We will see. 18 00:00:33,220 --> 00:00:36,300 So my name is Samuel Roses. I'm founder of 19 00:00:36,300 --> 00:00:38,160 Bullnex. Bullnex is a startup back in 20 00:00:38,160 --> 00:00:40,320 Spain. I used to work at Microsoft 21 00:00:40,320 --> 00:00:42,120 in the security team, but now 22 00:00:42,120 --> 00:00:44,100 I'm doing my own thing. I also won 23 00:00:44,100 --> 00:00:46,120 a DARPA, a US DARPA, so I went here 24 00:00:46,120 --> 00:00:47,840 I was invited here to the Pentagon 25 00:00:47,840 --> 00:00:50,200 so it was quite an interesting experience for me 26 00:00:50,200 --> 00:00:50,980 being a foreign. 27 00:00:51,860 --> 00:00:54,260 I usually go to many conferences and talk 28 00:00:54,260 --> 00:00:56,240 and so that's pretty much 29 00:00:56,240 --> 00:00:56,740 everything. 30 00:00:57,540 --> 00:00:59,520 So the objective of the talk 31 00:00:59,520 --> 00:01:02,020 are you guys hearing me fine? 32 00:01:02,640 --> 00:01:05,060 Okay. If I cough or anything, sorry about that 33 00:01:05,060 --> 00:01:05,980 because I'm a bit cold. 34 00:01:06,760 --> 00:01:08,860 Today I'm feeling better, but yesterday and Thursday 35 00:01:08,860 --> 00:01:09,860 I was miserable. 36 00:01:10,820 --> 00:01:12,560 But now hopefully I'm fine. 37 00:01:13,980 --> 00:01:15,240 So I will talk a little 38 00:01:15,240 --> 00:01:16,680 about some basic 39 00:01:16,680 --> 00:01:19,000 source code analysis. It will be quite basic. 40 00:01:19,400 --> 00:01:21,040 We will not go into too much detail 41 00:01:21,040 --> 00:01:23,100 how to do that. And then it will be more 42 00:01:23,760 --> 00:01:25,120 open source intelligence tactics. 43 00:01:25,520 --> 00:01:27,240 Stuff we are looking 44 00:01:27,240 --> 00:01:29,240 for. So I'm sure most of you are familiar 45 00:01:29,520 --> 00:01:29,680 with those. 46 00:01:30,840 --> 00:01:34,080 So how we can apply those to source code. 47 00:01:36,100 --> 00:01:38,520 So the agenda will be like an introduction. 48 00:01:38,740 --> 00:01:41,920 We will cover what we're going to achieve and why. 49 00:01:42,340 --> 00:01:44,680 We will start doing some open source intelligence 50 00:01:44,680 --> 00:01:48,180 on some developers and the source code. 51 00:01:48,400 --> 00:01:50,320 And then we will do some conclusions. 52 00:01:53,060 --> 00:01:56,140 Yeah, this is something I've been working. 53 00:01:56,340 --> 00:01:58,640 So this is work in progress and I thought, okay, let's go. 54 00:01:58,640 --> 00:02:02,640 Let's go to the Raccoon Village in DEF CON 55 00:02:02,640 --> 00:02:05,000 and show some ideas I'm working on. 56 00:02:05,140 --> 00:02:07,140 And hopefully people will have a nice discussion 57 00:02:07,140 --> 00:02:09,020 after some beers. That always helps. 58 00:02:09,600 --> 00:02:10,880 And how we can improve this. 59 00:02:11,000 --> 00:02:14,460 I think it's quite a new field. 60 00:02:14,580 --> 00:02:16,100 I haven't seen much people talking 61 00:02:16,100 --> 00:02:17,340 how to do open source intelligence 62 00:02:17,340 --> 00:02:19,900 in source code and also how to do 63 00:02:19,900 --> 00:02:22,020 developer profiling and all that stuff 64 00:02:22,020 --> 00:02:22,780 in source code. 65 00:02:23,000 --> 00:02:25,380 There's some research on that, but still 66 00:02:25,380 --> 00:02:27,640 it's an interesting field to get into. 67 00:02:27,880 --> 00:02:28,620 So I'm going to talk a little bit about that. 68 00:02:28,620 --> 00:02:31,400 So, okay, so I will show you what I'm working on, 69 00:02:31,500 --> 00:02:34,140 but I'm sure there's much more things we can do. 70 00:02:35,340 --> 00:02:38,300 So hopefully people can come up with some nice ideas 71 00:02:38,300 --> 00:02:40,520 and we can improve those. 72 00:02:42,500 --> 00:02:43,300 So introduction. 73 00:02:44,400 --> 00:02:47,620 I mean, I guess most of you are familiar with that, right? 74 00:02:47,740 --> 00:02:50,920 It was one of the famous Stephen Ballmer. 75 00:02:51,700 --> 00:02:53,300 When he was in Microsoft, not anymore, 76 00:02:53,520 --> 00:02:55,780 but when he was there, he gave a speech there 77 00:02:55,780 --> 00:02:58,440 and I haven't seen him. 78 00:02:58,620 --> 00:02:58,960 I haven't seen him in person 79 00:02:58,960 --> 00:03:00,680 and he's always like energy. 80 00:03:01,600 --> 00:03:03,920 Quite insane, actually, but funny. 81 00:03:05,580 --> 00:03:08,000 And here's one of the famous talks he was giving 82 00:03:08,000 --> 00:03:10,260 and he was saying developers, developers, developers, right? 83 00:03:10,560 --> 00:03:12,260 Of course, in Microsoft, it's one of the best, 84 00:03:12,320 --> 00:03:13,560 most important things, right? 85 00:03:13,760 --> 00:03:15,740 In the company, the NSS software company. 86 00:03:15,920 --> 00:03:17,520 So for many companies, it's the same, right? 87 00:03:17,900 --> 00:03:23,240 So, yeah, in this case, we think we will target, 88 00:03:23,400 --> 00:03:24,580 the idea is to target developers. 89 00:03:24,960 --> 00:03:27,200 We're going to get information through the developers. 90 00:03:31,500 --> 00:03:32,420 Why developers? 91 00:03:32,560 --> 00:03:33,760 I mean, I'm a developer myself, 92 00:03:34,040 --> 00:03:39,620 so I think it's quite interesting, right? 93 00:03:39,760 --> 00:03:41,560 Of course, this is only applied to companies 94 00:03:41,560 --> 00:03:42,900 who develop software, right? 95 00:03:43,060 --> 00:03:44,780 If the company doesn't have any developers, 96 00:03:45,460 --> 00:03:46,340 this is not going to help, 97 00:03:46,440 --> 00:03:49,140 but there are more and more companies 98 00:03:49,140 --> 00:03:51,360 having their own developer staff, right? 99 00:03:51,700 --> 00:03:55,600 So most of the time, developers are really technical people, 100 00:03:55,680 --> 00:03:57,280 but not security savvy. 101 00:03:57,620 --> 00:03:58,520 That's true. 102 00:03:58,520 --> 00:04:01,440 I know a lot of, when there are really good developers, 103 00:04:01,600 --> 00:04:03,120 they are not into too much security. 104 00:04:04,600 --> 00:04:06,020 So that's perfect for us. 105 00:04:06,180 --> 00:04:07,820 When we are doing open source intelligence, 106 00:04:08,100 --> 00:04:10,220 we can take some benefit there. 107 00:04:10,500 --> 00:04:12,740 And also developers, from my point of view, 108 00:04:12,920 --> 00:04:16,420 of course, I'm a developer and I do a few things, 109 00:04:16,500 --> 00:04:19,300 so I guess I'm not, I'm biased for that, 110 00:04:19,340 --> 00:04:21,240 but I guess, but in most companies, 111 00:04:21,740 --> 00:04:25,080 okay, there are no, like, decision makers most of the time, 112 00:04:25,220 --> 00:04:27,380 but quite often, there are infuers. 113 00:04:27,640 --> 00:04:28,200 So they can, 114 00:04:28,520 --> 00:04:32,380 they help high management where we should go, 115 00:04:32,540 --> 00:04:34,160 so there are people, 116 00:04:34,320 --> 00:04:36,160 so those guys are influencers, 117 00:04:36,400 --> 00:04:37,480 so that's good. 118 00:04:37,620 --> 00:04:41,300 They have some certain power in the company. 119 00:04:41,380 --> 00:04:41,900 Perfect. 120 00:04:42,260 --> 00:04:45,300 And also they usually have access to information and systems, 121 00:04:45,480 --> 00:04:46,340 so that's perfect. 122 00:04:47,140 --> 00:04:48,700 They can go to, 123 00:04:48,780 --> 00:04:50,740 they have maybe access to information or systems 124 00:04:50,740 --> 00:04:53,200 that other people in the company don't have. 125 00:04:53,700 --> 00:04:55,500 Sometimes they have too much information 126 00:04:55,500 --> 00:04:57,480 because they are developing and they, 127 00:04:57,580 --> 00:04:58,320 okay, I need, 128 00:04:58,420 --> 00:04:58,500 I need, 129 00:04:58,520 --> 00:04:59,720 I need full access to the system. 130 00:04:59,800 --> 00:05:00,420 Well, you don't need that, 131 00:05:00,460 --> 00:05:02,500 but most companies, okay, you get everything. 132 00:05:02,680 --> 00:05:03,480 So that's perfect. 133 00:05:03,600 --> 00:05:05,460 So, okay, that's quite convenient for us. 134 00:05:06,900 --> 00:05:09,860 And of course, there are habits there, right? 135 00:05:10,240 --> 00:05:12,240 I mean, you guys are developers, you know, 136 00:05:12,740 --> 00:05:13,900 we love science fiction. 137 00:05:14,500 --> 00:05:15,400 Who doesn't, right? 138 00:05:16,240 --> 00:05:18,380 If you don't, you are in the wrong room, I guess. 139 00:05:19,460 --> 00:05:21,600 Anime, a lot of people go for anime. 140 00:05:22,540 --> 00:05:24,400 Porn, I mean, of course, right? 141 00:05:24,740 --> 00:05:26,000 Not only developers, I guess, 142 00:05:26,100 --> 00:05:28,400 but that's something we can explain. 143 00:05:28,520 --> 00:05:29,860 And of course, beer, right? 144 00:05:29,940 --> 00:05:32,720 That's something that developers love. 145 00:05:33,060 --> 00:05:35,900 And we can benefit, I mean, we can expect that, right? 146 00:05:36,040 --> 00:05:37,120 And we are getting information, 147 00:05:37,240 --> 00:05:39,140 and then we are going to do more, like, 148 00:05:39,140 --> 00:05:39,820 social engineering attacks. 149 00:05:40,080 --> 00:05:43,180 I'm not going to talk about social engineering attacks here 150 00:05:43,180 --> 00:05:44,500 because that's not what I want. 151 00:05:44,660 --> 00:05:47,200 But after I pull out all the information I need, 152 00:05:47,420 --> 00:05:49,740 I can, I know information about developers, 153 00:05:50,180 --> 00:05:52,800 and I can focus on those areas that chances are 154 00:05:52,800 --> 00:05:54,760 I will be able to attract his attention 155 00:05:55,640 --> 00:05:56,600 through these habits. 156 00:05:56,760 --> 00:05:58,160 And that's quite common to see that. 157 00:06:02,220 --> 00:06:04,740 So, methodology, I like to follow. 158 00:06:05,840 --> 00:06:07,320 Instead of just going, for example, 159 00:06:07,320 --> 00:06:09,220 I have to target a company, right? 160 00:06:09,400 --> 00:06:12,440 We usually start with the domains, the IPs. 161 00:06:13,700 --> 00:06:16,040 Maybe, hopefully, I can do some Google searches, 162 00:06:16,320 --> 00:06:18,420 try to find some emails, and stuff like that. 163 00:06:18,480 --> 00:06:20,780 That's usually, most of us start, right? 164 00:06:21,120 --> 00:06:23,220 Okay, so the way I went is, 165 00:06:23,680 --> 00:06:25,440 okay, I have to target a company. 166 00:06:26,400 --> 00:06:28,180 At this point, I don't know anyone. 167 00:06:28,180 --> 00:06:29,540 I don't know anyone there, but hopefully, 168 00:06:30,140 --> 00:06:32,700 I can go and check if they have any GitHub reports 169 00:06:32,700 --> 00:06:33,460 or something like that. 170 00:06:33,620 --> 00:06:35,120 Okay, so let's go to the reports 171 00:06:35,520 --> 00:06:36,800 and start downloading those. 172 00:06:38,320 --> 00:06:40,380 So, I will start downloading the reports, 173 00:06:40,520 --> 00:06:41,460 the code reports, and now, 174 00:06:41,540 --> 00:06:45,080 the GitHub is a huge thing these days, right? 175 00:06:45,200 --> 00:06:47,380 So, that's the place I will go to start there. 176 00:06:48,140 --> 00:06:51,520 And then I will start looking for open source patterns in code. 177 00:06:51,900 --> 00:06:53,920 So, I will do some of the things I usually do 178 00:06:53,920 --> 00:06:56,120 in Google searches and stuff like that, 179 00:06:56,160 --> 00:06:57,500 but applying it to source code. 180 00:06:58,620 --> 00:07:01,000 And after that, I have a bunch of information there. 181 00:07:01,360 --> 00:07:03,820 Of course, I will go more traditional way 182 00:07:03,820 --> 00:07:06,780 with social networks and different tools and stuff, right? 183 00:07:06,940 --> 00:07:09,940 So, that's the way I'm going with this. 184 00:07:13,300 --> 00:07:15,280 Of course, things we can look at, 185 00:07:15,300 --> 00:07:18,080 we can search in the patterns. 186 00:07:18,200 --> 00:07:20,520 We can start searching in the code, right? 187 00:07:20,640 --> 00:07:21,840 We have some of the classic things. 188 00:07:21,980 --> 00:07:24,120 Usually, we do in Google searches 189 00:07:24,120 --> 00:07:26,120 or with different tools, right? 190 00:07:26,160 --> 00:07:26,920 We look for APIs, 191 00:07:28,180 --> 00:07:32,680 Domain names, URLs, emails, credit cards, 192 00:07:32,820 --> 00:07:35,500 maybe in source code sometimes, phone numbers. 193 00:07:35,700 --> 00:07:36,980 We can also find phone numbers. 194 00:07:37,080 --> 00:07:38,660 So there's a bunch of different information there 195 00:07:39,560 --> 00:07:42,180 we can start pulling out in source code. 196 00:07:42,360 --> 00:07:48,460 Usually, I've been doing code reviews for a long time. 197 00:07:48,620 --> 00:07:49,960 So actually, now these days, 198 00:07:50,000 --> 00:07:51,960 people are starting to put in more comments 199 00:07:51,960 --> 00:07:55,140 and nicer in the source code, 200 00:07:55,220 --> 00:07:56,740 and that's quite nice for us. 201 00:07:56,740 --> 00:07:59,320 If you start looking at old code, 202 00:07:59,500 --> 00:08:01,580 pretty much there's no comments or anything. 203 00:08:02,840 --> 00:08:04,440 So for us right now, 204 00:08:04,500 --> 00:08:06,500 most modern code is quite perfect. 205 00:08:06,840 --> 00:08:09,220 And actually, things we can start looking into 206 00:08:09,220 --> 00:08:11,240 in source code as well is Twitter alias. 207 00:08:12,860 --> 00:08:14,420 That's not so common. 208 00:08:14,540 --> 00:08:16,020 Actually, when you go to the GitHub report, 209 00:08:16,160 --> 00:08:18,280 people usually put the alias there, 210 00:08:18,380 --> 00:08:18,840 so it's perfect. 211 00:08:18,940 --> 00:08:19,800 Now I have that information. 212 00:08:20,160 --> 00:08:21,540 I can start doing more things. 213 00:08:21,920 --> 00:08:23,340 But usually in the source code, 214 00:08:23,460 --> 00:08:25,060 I haven't seen so often. 215 00:08:25,160 --> 00:08:26,560 People usually, they put their name 216 00:08:26,560 --> 00:08:26,720 and their name on the source code. 217 00:08:26,740 --> 00:08:27,260 And maybe the email, 218 00:08:27,400 --> 00:08:29,940 but not so often the Twitter alias. 219 00:08:30,100 --> 00:08:33,400 But that's something we should start looking at. 220 00:08:33,680 --> 00:08:35,060 And of course, the comments. 221 00:08:36,120 --> 00:08:38,500 It depends how well people write their comments 222 00:08:38,500 --> 00:08:41,120 and in detail and stuff like that. 223 00:08:41,240 --> 00:08:42,460 But sometimes we can also find 224 00:08:42,460 --> 00:08:44,480 some interesting piece of information in the comments. 225 00:08:44,640 --> 00:08:48,180 So that's the thing I will start looking into source codes. 226 00:08:53,800 --> 00:08:56,620 So, right, give me a source code. 227 00:08:56,740 --> 00:08:56,820 Right? 228 00:08:56,880 --> 00:08:58,960 So usually we don't have any documentation. 229 00:08:59,100 --> 00:09:00,260 I don't care about that. 230 00:09:00,340 --> 00:09:01,540 In this case, usually when you ask, 231 00:09:01,660 --> 00:09:03,360 when I do code reviews, 232 00:09:03,520 --> 00:09:04,400 I usually ask for documentation, 233 00:09:04,600 --> 00:09:05,820 but usually they don't give me any. 234 00:09:06,140 --> 00:09:07,340 So I'm used to the real code. 235 00:09:07,580 --> 00:09:08,860 So in this case, it's perfect. 236 00:09:09,080 --> 00:09:12,020 In this case, we download the repos. 237 00:09:12,140 --> 00:09:14,860 And now we have to focus on the source code. 238 00:09:15,200 --> 00:09:18,340 So yeah, we will start reading the source code. 239 00:09:18,620 --> 00:09:19,780 I mean, it doesn't mean, 240 00:09:20,060 --> 00:09:20,780 it doesn't need, 241 00:09:20,920 --> 00:09:23,360 actually we don't need to really read the source code. 242 00:09:23,420 --> 00:09:25,060 We will do some search there, 243 00:09:25,160 --> 00:09:26,660 so we don't have to go through the code. 244 00:09:26,740 --> 00:09:27,480 It's up to you. 245 00:09:27,660 --> 00:09:28,900 It depends what you're looking for. 246 00:09:31,620 --> 00:09:33,860 And here we can start some examples, right? 247 00:09:35,640 --> 00:09:36,420 Here we have, 248 00:09:36,500 --> 00:09:37,940 we start doing some, 249 00:09:38,480 --> 00:09:40,280 for example, I have here a target. 250 00:09:40,880 --> 00:09:42,400 It can be a person, a company, 251 00:09:42,500 --> 00:09:43,200 but now, for example, 252 00:09:43,260 --> 00:09:43,860 look at this. 253 00:09:43,900 --> 00:09:44,540 This is the header. 254 00:09:44,740 --> 00:09:46,620 I'm opening this program. 255 00:09:46,760 --> 00:09:47,880 This is the American Fuzzy Lab. 256 00:09:48,120 --> 00:09:48,760 It's a fuzzer, 257 00:09:49,220 --> 00:09:50,640 a very popular fuzzer. 258 00:09:51,060 --> 00:09:52,800 Okay, so just looking by the header, 259 00:09:52,940 --> 00:09:53,820 that's quite common, 260 00:09:53,980 --> 00:09:56,380 that people write headers into the source code. 261 00:09:56,740 --> 00:09:58,080 It's a C program. 262 00:09:58,440 --> 00:09:59,540 As you can see at the end, 263 00:10:01,160 --> 00:10:01,960 flanalyze.c. 264 00:10:02,040 --> 00:10:02,800 It's a C program. 265 00:10:03,560 --> 00:10:04,900 But now, for example, here, 266 00:10:05,120 --> 00:10:07,460 for example, I'm supposed to target this company, 267 00:10:07,600 --> 00:10:07,780 whatever. 268 00:10:08,420 --> 00:10:10,500 But now I have like three pieces of information. 269 00:10:10,540 --> 00:10:11,340 I can start work. 270 00:10:11,600 --> 00:10:13,300 So I downloaded this repo, 271 00:10:13,440 --> 00:10:14,860 and now I know, for example, 272 00:10:14,860 --> 00:10:15,560 I have a name, 273 00:10:15,640 --> 00:10:16,940 I have an email address, 274 00:10:17,220 --> 00:10:18,340 and I have a company. 275 00:10:19,280 --> 00:10:20,580 So from this, 276 00:10:20,780 --> 00:10:23,540 I just got three pieces of information. 277 00:10:23,780 --> 00:10:25,120 Now I can, okay, 278 00:10:25,280 --> 00:10:26,380 I can start getting that, 279 00:10:26,740 --> 00:10:27,040 that information. 280 00:10:27,360 --> 00:10:28,420 I can start working, 281 00:10:28,420 --> 00:10:29,480 going and get more, 282 00:10:29,500 --> 00:10:29,980 more info. 283 00:10:30,140 --> 00:10:31,480 So for just looking at the header, 284 00:10:31,540 --> 00:10:32,340 now I have three things. 285 00:10:32,860 --> 00:10:34,540 By just downloading this code, 286 00:10:34,820 --> 00:10:35,460 I can start, 287 00:10:35,600 --> 00:10:38,640 I can start applying more techniques. 288 00:10:41,240 --> 00:10:41,900 Same here. 289 00:10:42,040 --> 00:10:43,640 Now I have downloaded the AirCag, 290 00:10:46,600 --> 00:10:47,700 AirCag source code, 291 00:10:47,840 --> 00:10:48,820 and again, 292 00:10:48,920 --> 00:10:49,700 I have actually, 293 00:10:50,780 --> 00:10:51,820 and now it's the same. 294 00:10:51,900 --> 00:10:53,640 I have several pieces of information 295 00:10:53,640 --> 00:10:54,480 that are quite interesting. 296 00:10:55,440 --> 00:10:56,020 There's a, 297 00:10:56,020 --> 00:10:57,140 we can see there's somebody, 298 00:10:57,620 --> 00:10:59,980 Christopher started in 2004, 2005, 299 00:11:00,220 --> 00:11:01,160 how he started the project, 300 00:11:01,420 --> 00:11:03,460 but now Thomas has taken over. 301 00:11:03,740 --> 00:11:05,000 So we can see there's a relationship. 302 00:11:05,300 --> 00:11:07,380 Those two guys have been working on the same project, 303 00:11:07,480 --> 00:11:09,380 and one of them took the over. 304 00:11:09,640 --> 00:11:10,200 Okay, that's, 305 00:11:10,200 --> 00:11:11,520 we're starting to create relationships. 306 00:11:12,260 --> 00:11:13,260 So that's interesting. 307 00:11:13,400 --> 00:11:13,880 You guys know, 308 00:11:14,020 --> 00:11:15,640 in social networks and stuff like that, 309 00:11:15,640 --> 00:11:16,980 we do a lot of relationship analysis. 310 00:11:17,360 --> 00:11:19,480 So now we're starting making relationships there. 311 00:11:19,620 --> 00:11:20,020 And right now, 312 00:11:20,080 --> 00:11:21,560 I'm doing this in my mind, 313 00:11:21,660 --> 00:11:24,220 but we can start writing that down. 314 00:11:24,440 --> 00:11:25,500 And that's how we can see this, 315 00:11:25,500 --> 00:11:27,400 there's more people there that are mentioned. 316 00:11:27,540 --> 00:11:28,560 So I have more names. 317 00:11:28,720 --> 00:11:30,080 So I can start linking, 318 00:11:30,160 --> 00:11:31,480 okay, there's people in the relationship. 319 00:11:31,780 --> 00:11:33,860 Then maybe I can go to social, 320 00:11:33,980 --> 00:11:34,880 different social networks, 321 00:11:35,140 --> 00:11:37,040 and start seeing they are following each other, 322 00:11:37,200 --> 00:11:38,060 or what they say, 323 00:11:38,160 --> 00:11:38,840 they are friends or not. 324 00:11:39,060 --> 00:11:41,760 So I'm here starting relationships. 325 00:11:42,780 --> 00:11:44,880 They want to move other type of, 326 00:11:44,900 --> 00:11:46,260 like social media attacks or whatever. 327 00:11:46,880 --> 00:11:47,980 Probably with these guys, 328 00:11:48,040 --> 00:11:48,680 it's not gonna work, 329 00:11:48,760 --> 00:11:50,320 but that's just an example, right? 330 00:11:50,580 --> 00:11:52,560 But that's the way I will start. 331 00:11:52,840 --> 00:11:53,700 So, okay, 332 00:11:53,780 --> 00:11:55,400 so now we have starting names. 333 00:11:55,400 --> 00:11:56,340 Names and relationships, 334 00:11:56,600 --> 00:11:57,220 so that's good. 335 00:11:57,480 --> 00:12:01,480 So now we have some information I can start work with. 336 00:12:05,140 --> 00:12:08,120 So I guess some tools, right? 337 00:12:08,280 --> 00:12:10,100 At the end, it's all about the tools, right? 338 00:12:16,020 --> 00:12:16,940 So in this case, 339 00:12:18,520 --> 00:12:21,780 I'm gonna cover some different tools we can start using. 340 00:12:22,120 --> 00:12:23,080 There are many more, 341 00:12:23,160 --> 00:12:25,280 but I guess some of the most I use, 342 00:12:25,400 --> 00:12:27,400 and I'm sure in time I will add more. 343 00:12:27,860 --> 00:12:28,640 That's for sure. 344 00:12:28,880 --> 00:12:30,520 And some of the tools I'm using 345 00:12:30,520 --> 00:12:31,880 have to improve a lot as well. 346 00:12:32,120 --> 00:12:33,240 So, but at least we, 347 00:12:33,360 --> 00:12:36,820 so, but there are some tools we can start using right away. 348 00:12:36,920 --> 00:12:37,640 So I think they are nice. 349 00:12:39,600 --> 00:12:43,940 Okay, one of the first tool I like is githubrank.com. 350 00:12:44,620 --> 00:12:47,500 And it's a nice tool to give you a ranking 351 00:12:47,500 --> 00:12:50,220 of the different reports in GitHub. 352 00:12:50,820 --> 00:12:53,300 So we can, for example, this is, 353 00:12:53,300 --> 00:12:56,060 I told, I gave me the rank of all the top, 354 00:12:56,080 --> 00:12:58,920 top for GitHub in relative to C language. 355 00:12:59,160 --> 00:13:02,860 Of course, the first one is a Linux source code, 356 00:13:02,960 --> 00:13:05,340 and we hear Tor Wells there, right? 357 00:13:06,000 --> 00:13:07,560 So that's quite interesting. 358 00:13:07,860 --> 00:13:10,040 And this site can tell me to start getting, 359 00:13:10,340 --> 00:13:12,660 if I'm looking for particular reports, 360 00:13:12,940 --> 00:13:15,140 I can see how popular they are, 361 00:13:15,280 --> 00:13:17,880 and people are downloading, or stuff like that. 362 00:13:18,000 --> 00:13:19,580 So, okay, that's a good start 363 00:13:20,000 --> 00:13:22,240 to get a feeling of the popularity of this report. 364 00:13:22,240 --> 00:13:24,220 It doesn't, it doesn't make sense here. 365 00:13:24,320 --> 00:13:27,860 I'm targeting a company to look for open source intelligence, 366 00:13:28,060 --> 00:13:30,060 and I start looking for reports that doesn't have any, 367 00:13:30,560 --> 00:13:32,440 any value, I'm just wasting my time. 368 00:13:33,940 --> 00:13:35,540 So yeah, that's a good way to start 369 00:13:35,540 --> 00:13:37,840 to get some feeling of the popularity of the report. 370 00:13:38,060 --> 00:13:39,220 Okay, cool. 371 00:13:39,320 --> 00:13:41,380 So you can see there's a lot of interesting stuff there. 372 00:13:43,520 --> 00:13:46,380 Another tool I like is githubwrap. 373 00:13:47,700 --> 00:13:48,940 Anyone familiar with this tool? 374 00:13:49,120 --> 00:13:50,800 That was released a couple of years ago. 375 00:13:51,040 --> 00:13:51,920 Actually, the tool, 376 00:13:52,240 --> 00:13:53,800 the idea of the tool is to 377 00:13:55,560 --> 00:13:58,440 reconnaissance github repos for private keys 378 00:13:58,440 --> 00:14:00,140 and credentials and stuff like that. 379 00:14:00,220 --> 00:14:01,760 But it gives you more information we can use 380 00:14:01,760 --> 00:14:04,520 for a more open source intelligence approach. 381 00:14:05,200 --> 00:14:07,640 So the tool looks for credentials and private keys 382 00:14:07,640 --> 00:14:08,360 and different stuff. 383 00:14:08,640 --> 00:14:10,140 So it's quite nice to use 384 00:14:12,000 --> 00:14:14,500 for our purpose, to start. 385 00:14:16,700 --> 00:14:19,060 And this is the tool. 386 00:14:19,060 --> 00:14:24,500 It will go to a repo, and start downloading those repos 387 00:14:24,500 --> 00:14:26,400 and the users and some information 388 00:14:26,840 --> 00:14:28,140 that's quite interesting for me. 389 00:14:28,300 --> 00:14:31,400 So this is the UI of the tool. 390 00:14:31,480 --> 00:14:32,780 It's a web application. 391 00:14:33,420 --> 00:14:34,100 So it's quite nice. 392 00:14:34,380 --> 00:14:36,340 So let me show you. 393 00:14:36,540 --> 00:14:37,620 Okay, let's go there. 394 00:14:42,480 --> 00:14:44,260 I have it running here locally. 395 00:14:57,500 --> 00:14:57,900 Let me show you. 396 00:15:08,860 --> 00:15:09,900 Come on, come on. 397 00:15:10,240 --> 00:15:10,640 Ah. 398 00:15:10,820 --> 00:15:12,060 Because I don't have any connections, 399 00:15:12,140 --> 00:15:14,020 it's time to connect outside. 400 00:15:14,120 --> 00:15:15,800 So we'll timeout. 401 00:15:16,040 --> 00:15:18,800 Well, actually, hopefully when it's timeout, 402 00:15:18,800 --> 00:15:19,600 they will give me the images. 403 00:15:19,740 --> 00:15:21,400 The tool, what it does, it will start showing, 404 00:15:22,040 --> 00:15:24,800 this is a different repos of, 405 00:15:25,220 --> 00:15:29,000 usually the way it works, you will give the tool here, 406 00:15:29,580 --> 00:15:31,800 you go to a new assessment, and it will ask you 407 00:15:31,800 --> 00:15:34,480 for like a organization name or a repo, 408 00:15:34,640 --> 00:15:37,420 and it will go there and pull out information there. 409 00:15:38,700 --> 00:15:39,100 Okay. 410 00:15:40,900 --> 00:15:43,060 So, now it's trying to connect, it's not connecting. 411 00:15:43,300 --> 00:15:45,160 Okay, so actually here by the name, 412 00:15:45,180 --> 00:15:47,380 I start pulling some repos. 413 00:15:47,380 --> 00:15:49,920 Of course, usually when this, when it has connection here, 414 00:15:50,060 --> 00:15:50,820 it will show you the images. 415 00:15:51,080 --> 00:15:53,380 Now it's trying to connect externally, 416 00:15:53,480 --> 00:15:56,340 and I have the Wi-Fi turned off, I don't know why. 417 00:15:57,740 --> 00:15:59,880 But, so now it's not showing the image. 418 00:16:00,020 --> 00:16:01,820 But anyways, I pretty much know that. 419 00:16:01,920 --> 00:16:04,280 So, first one is the repo for Raspberry, 420 00:16:05,760 --> 00:16:11,440 ID Software, PLC, which are some popular repos. 421 00:16:11,440 --> 00:16:15,300 I started getting, also Nmap, Metasploit, 422 00:16:15,440 --> 00:16:16,540 just to give me an idea. 423 00:16:17,380 --> 00:16:17,780 Yeah, all the people. 424 00:16:17,920 --> 00:16:19,480 If we go, for example, for the first one, 425 00:16:20,540 --> 00:16:21,120 let's go there. 426 00:16:22,280 --> 00:16:25,200 Yeah, here the tool, as I say, is looking for credential, 427 00:16:25,780 --> 00:16:28,180 credential, and buyback key, so that's, 428 00:16:28,180 --> 00:16:31,580 so you guys have, your company did have repos. 429 00:16:31,640 --> 00:16:34,700 It's a nice tool just to make sure you have not published 430 00:16:34,700 --> 00:16:36,200 any credential or anything like that. 431 00:16:36,340 --> 00:16:39,100 But I'm not using the tool right now in that sense. 432 00:16:39,320 --> 00:16:44,160 What I'm looking for is the user epos. 433 00:16:44,320 --> 00:16:45,400 That's something I'm interested. 434 00:16:45,620 --> 00:16:46,900 I don't know if we're gonna show me the pictures. 435 00:16:47,820 --> 00:16:48,420 Let's see. 436 00:16:49,180 --> 00:16:50,920 Oh, it's not showing me the pictures 437 00:16:50,920 --> 00:16:51,940 because it's a connection. 438 00:16:58,620 --> 00:17:00,000 It's trying to connect there. 439 00:17:03,580 --> 00:17:04,040 Okay. 440 00:17:05,640 --> 00:17:07,680 I didn't check that, but, so. 441 00:17:09,000 --> 00:17:10,680 But I came prepared just in case. 442 00:17:18,280 --> 00:17:20,440 Okay, so I put a video because it's trying to connect 443 00:17:20,440 --> 00:17:21,860 all the time and it's not showing me the pictures. 444 00:17:22,080 --> 00:17:24,540 But just in case, I did a small video 445 00:17:25,620 --> 00:17:27,360 because this is DefCon and you don't know. 446 00:17:27,780 --> 00:17:30,440 So this is, when you have the repos, 447 00:17:30,460 --> 00:17:31,240 it's showing you the pictures. 448 00:17:31,460 --> 00:17:33,180 And this interesting thing is it starts showing me 449 00:17:33,180 --> 00:17:36,080 the users and what pieces of code they have been working. 450 00:17:36,300 --> 00:17:36,900 So that's nice. 451 00:17:37,000 --> 00:17:37,840 Now I have information. 452 00:17:38,340 --> 00:17:39,940 I start seeing relationships there. 453 00:17:40,160 --> 00:17:42,460 Well, this is one of the repos I did software 454 00:17:42,460 --> 00:17:43,580 with the Doom game. 455 00:17:44,300 --> 00:17:46,020 Who doesn't love the game, the Doom, right? 456 00:17:46,160 --> 00:17:46,980 From the old days. 457 00:17:46,980 --> 00:17:50,100 And we'll take a look in a little bit as well at the Doom. 458 00:17:50,220 --> 00:17:53,900 So here we have some repos and map, metasploit and stuff. 459 00:17:54,080 --> 00:17:55,780 I don't think that's the original metasploit, 460 00:17:55,860 --> 00:17:58,380 but anyways, it's nice to take a look. 461 00:17:58,800 --> 00:18:00,740 So yeah, we can see the different pictures. 462 00:18:00,880 --> 00:18:03,100 And pictures can tell us a lot of information there. 463 00:18:04,840 --> 00:18:10,420 Okay, if we go to the Raspberry repo, 464 00:18:10,560 --> 00:18:11,600 we can see all the files here. 465 00:18:13,280 --> 00:18:15,300 But as some say, I'm not really interesting 466 00:18:15,300 --> 00:18:16,280 in that at the moment. 467 00:18:16,280 --> 00:18:19,320 Well, when I'm looking for popularities, of course I am. 468 00:18:19,560 --> 00:18:21,620 But right now I'm more interesting in the users. 469 00:18:21,940 --> 00:18:24,440 And what information I can get from those users. 470 00:18:24,700 --> 00:18:26,720 And that tool is quite convenient. 471 00:18:28,500 --> 00:18:31,600 For example, this is one of the developers, Damien. 472 00:18:32,740 --> 00:18:33,600 I can click. 473 00:18:34,040 --> 00:18:38,020 And now he's giving me some info there. 474 00:18:38,160 --> 00:18:38,820 Move there. 475 00:18:40,840 --> 00:18:43,140 Okay, so now I have a name. 476 00:18:43,320 --> 00:18:45,200 I have a place he's working. 477 00:18:46,280 --> 00:18:46,820 A location. 478 00:18:47,080 --> 00:18:48,300 And a Twitter account. 479 00:18:48,740 --> 00:18:51,380 So now I have a bunch of information I can keep going 480 00:18:51,380 --> 00:18:54,880 and start targeting more and more of this user, right? 481 00:18:55,200 --> 00:18:56,960 So that's quite convenient for me. 482 00:18:58,760 --> 00:19:01,440 And of course, the nice of the tool is that 483 00:19:01,800 --> 00:19:05,120 all information is put into PostgreSQL Server. 484 00:19:05,340 --> 00:19:07,840 So everything, what you see here is stored in a SQL Server. 485 00:19:08,020 --> 00:19:10,800 So you can also make your own queries and search for info. 486 00:19:10,920 --> 00:19:11,960 So that's quite convenient. 487 00:19:12,180 --> 00:19:13,940 Find this tool quite nice. 488 00:19:14,280 --> 00:19:15,780 It's a simple tool, but very nice. 489 00:19:16,280 --> 00:19:17,400 So now I have the Twitter account. 490 00:19:17,560 --> 00:19:18,880 I can do more things. 491 00:19:19,200 --> 00:19:20,680 We will do that in a little bit. 492 00:19:21,660 --> 00:19:24,380 Okay, I can look at the pictures. 493 00:19:25,140 --> 00:19:26,840 And give me an idea of the... 494 00:19:26,840 --> 00:19:28,820 This should be a fun guy, I guess. 495 00:19:31,840 --> 00:19:33,600 Okay, I have a mail address. 496 00:19:34,060 --> 00:19:37,760 Yeah, of course, I can go to Google 497 00:19:37,760 --> 00:19:39,920 and do some searches and stuff like that. 498 00:19:40,060 --> 00:19:43,200 But right now, I want to avoid that for a reason. 499 00:19:43,500 --> 00:19:46,120 Actually, there are more counterintelligence companies. 500 00:19:46,280 --> 00:19:49,180 Creating fake information on social networks 501 00:19:49,180 --> 00:19:51,520 and all that stuff, and they monitor those sites. 502 00:19:51,740 --> 00:19:54,100 But right now, the repos are not that monitored. 503 00:19:54,400 --> 00:19:55,720 So now I'm getting a lot of info 504 00:19:55,720 --> 00:19:57,760 without going for social networks at the moment. 505 00:19:58,000 --> 00:20:00,920 So trying to avoid those counterintelligence companies. 506 00:20:01,260 --> 00:20:04,460 So that's one of the things I'm trying with this research. 507 00:20:07,480 --> 00:20:09,320 So yeah, I have location there, 508 00:20:09,540 --> 00:20:13,480 and I can start putting this info 509 00:20:13,480 --> 00:20:16,080 and use other well-known tools, 510 00:20:16,280 --> 00:20:19,000 as we use with this, right? 511 00:20:19,140 --> 00:20:19,820 So it's quite convenient. 512 00:20:20,180 --> 00:20:22,620 Okay, so that was the GitHub repo. 513 00:20:22,820 --> 00:20:24,520 I found this tool quite nice. 514 00:20:33,860 --> 00:20:35,380 It's not showing me the pictures, no. 515 00:20:35,680 --> 00:20:37,700 Well, there were a few more pictures I wanted to show, 516 00:20:37,780 --> 00:20:38,800 but I cannot do that. 517 00:20:38,940 --> 00:20:40,720 So I didn't tell without connection. 518 00:20:40,820 --> 00:20:41,840 I was all the time connected, 519 00:20:41,940 --> 00:20:44,040 so I didn't realize I need connection for that. 520 00:20:44,180 --> 00:20:45,300 But anyway, just go. 521 00:20:45,300 --> 00:20:47,400 And it's very easy to set up. 522 00:20:47,560 --> 00:20:49,920 So that was good, 523 00:20:50,040 --> 00:20:52,100 because usually open-source tools are a pain in the ass. 524 00:20:52,800 --> 00:20:54,920 But that one is quite easy to install and use. 525 00:20:55,140 --> 00:20:56,420 So give it a try. 526 00:20:56,540 --> 00:20:57,820 It's a nice tool. 527 00:20:59,240 --> 00:20:59,880 Okay, so. 528 00:21:01,580 --> 00:21:02,640 The only thing is in Ruby, 529 00:21:02,780 --> 00:21:05,160 but that's the only thing I can complain of. 530 00:21:05,880 --> 00:21:09,500 So now, okay, so that was Gitrop. 531 00:21:09,640 --> 00:21:11,880 So a nice tool to start getting some information 532 00:21:11,880 --> 00:21:14,040 of the users and their repos and connections. 533 00:21:16,320 --> 00:21:18,340 There's, of course, there's a lot of crawlers. 534 00:21:18,740 --> 00:21:19,980 And there are many more. 535 00:21:20,080 --> 00:21:23,040 That's some of the crawlers I have seen. 536 00:21:25,820 --> 00:21:27,980 And writing your own code is also easy. 537 00:21:28,300 --> 00:21:29,320 It's not that hard, I mean. 538 00:21:29,540 --> 00:21:32,880 So if you don't want to use Gitrop, 539 00:21:32,940 --> 00:21:34,220 you can just, for example, go this. 540 00:21:34,280 --> 00:21:36,720 The first two are Python-based, 541 00:21:36,840 --> 00:21:40,660 and the other one, I think it's in JavaScript. 542 00:21:41,040 --> 00:21:42,040 So there are many more. 543 00:21:42,120 --> 00:21:44,280 I think there are some Ruby crawlers. 544 00:21:45,300 --> 00:21:47,860 A lot of people have been releasing GitHub crawlers 545 00:21:47,860 --> 00:21:48,680 we can use. 546 00:21:49,260 --> 00:21:52,440 And we don't want to use the Gitrop tool seen before. 547 00:21:52,660 --> 00:21:56,020 We can use those crawlers and pull the, 548 00:21:56,240 --> 00:21:59,600 or we can also do a cron, git cron, that works too. 549 00:21:59,700 --> 00:22:03,580 But that allows us to do a lot of repos at the same time. 550 00:22:03,800 --> 00:22:05,880 So some of the tools we can start using, 551 00:22:06,060 --> 00:22:08,160 especially if we want to automatize things. 552 00:22:11,380 --> 00:22:13,880 Okay, so another thing I've been working on lately, 553 00:22:14,040 --> 00:22:14,760 and that's quite a thing, 554 00:22:14,760 --> 00:22:17,940 I mean, we're in DEF CON, so I guess everything is allowed. 555 00:22:18,140 --> 00:22:19,380 But anyways, just to make sure, 556 00:22:20,880 --> 00:22:23,240 if any, hopefully you guys don't get offenses. 557 00:22:23,860 --> 00:22:26,200 It's not me, it's the source code. 558 00:22:27,580 --> 00:22:29,420 So don't get offense or anything like that, 559 00:22:29,480 --> 00:22:31,480 but you will be surprised what you can see in source code. 560 00:22:32,980 --> 00:22:36,140 And the idea for this is to look for bad words 561 00:22:36,140 --> 00:22:37,440 in the source code, 562 00:22:37,480 --> 00:22:41,120 because this is some basic developer profiling. 563 00:22:41,260 --> 00:22:43,080 I want to get a feeling how these guys feel. 564 00:22:45,020 --> 00:22:48,120 And I want to be, is this guy angry or not? 565 00:22:49,880 --> 00:22:52,520 And source code is, so I've been working in, 566 00:22:52,540 --> 00:22:54,400 usually in Twitter it's quite common to do that, 567 00:22:54,440 --> 00:22:57,480 the sentiment analysis, we'll talk about that a little bit. 568 00:22:57,820 --> 00:23:00,140 And I apply the same techniques into source code. 569 00:23:00,260 --> 00:23:03,260 That's a bit tricky, that we have to still, 570 00:23:03,420 --> 00:23:05,700 it needs more work, for sure. 571 00:23:06,280 --> 00:23:10,080 But yeah, so I will show you a few things, right? 572 00:23:12,100 --> 00:23:14,140 So you look into the Linux, 573 00:23:14,760 --> 00:23:15,240 and the source code. 574 00:23:17,420 --> 00:23:20,180 This is for real, this is what you can find 575 00:23:20,180 --> 00:23:23,180 in the Linux source code, so you can see, 576 00:23:23,320 --> 00:23:26,160 I guess at some point, I can move with this, 577 00:23:26,300 --> 00:23:29,740 I don't, I'm not sure, so you can see between 578 00:23:31,720 --> 00:23:33,940 versions there, two, six, nine, and three, 579 00:23:33,980 --> 00:23:36,300 something happened, I don't know what happened there, 580 00:23:36,440 --> 00:23:39,320 I guess it was, I don't know what happened there, 581 00:23:39,340 --> 00:23:41,960 but there was a lot of shit and crap 582 00:23:41,960 --> 00:23:44,280 and everything, pretty much, so I guess they were working 583 00:23:44,280 --> 00:23:46,000 on something new, I guess. 584 00:23:46,580 --> 00:23:48,420 But you can see that there. 585 00:23:48,560 --> 00:23:50,800 So there was a lot of ugliness there going on. 586 00:23:50,920 --> 00:23:52,280 And the thing is just going up. 587 00:23:52,680 --> 00:23:55,000 So I guess it's not something, but that's funny. 588 00:23:55,140 --> 00:23:57,380 That gave me an idea what's going on with those people. 589 00:23:59,840 --> 00:24:02,840 So yeah, but everything is not that bad. 590 00:24:03,020 --> 00:24:05,400 I mean, it's not only bad words. 591 00:24:05,580 --> 00:24:07,000 You can also find good words. 592 00:24:07,180 --> 00:24:08,620 Okay, so that's fine, right? 593 00:24:08,880 --> 00:24:11,960 So we have some love, we have some good, nice, 594 00:24:11,980 --> 00:24:13,320 and sweet, and kids, right? 595 00:24:13,320 --> 00:24:15,280 But looking at both things, 596 00:24:15,360 --> 00:24:17,060 we can see more ugliness than happiness. 597 00:24:17,320 --> 00:24:20,120 So we should be concerned about that, I don't know. 598 00:24:20,540 --> 00:24:22,420 But yeah, so not everything is bad. 599 00:24:22,860 --> 00:24:24,440 So that's good. 600 00:24:24,580 --> 00:24:28,880 If you go to that URL, you will find more funny metrics, 601 00:24:29,020 --> 00:24:31,540 like this one, just related to the Linux kernel. 602 00:24:31,760 --> 00:24:32,960 So it's quite funny. 603 00:24:33,460 --> 00:24:33,940 Okay. 604 00:24:37,060 --> 00:24:39,820 So let's do the same for the reports we are working on. 605 00:24:42,020 --> 00:24:42,880 One other thing, 606 00:24:42,880 --> 00:24:44,660 one thing I've been, when I've been doing this, 607 00:24:44,820 --> 00:24:47,840 is you guys seem to more data science 608 00:24:47,840 --> 00:24:50,600 with all the process in data science with information. 609 00:24:51,320 --> 00:24:53,800 There is the process we have to data cleaning, right? 610 00:24:54,040 --> 00:24:57,520 You get information, but not all information you need is, 611 00:24:57,520 --> 00:24:59,980 is what, you don't need all the information you collect. 612 00:25:00,240 --> 00:25:01,120 You have to do some cleaning. 613 00:25:01,880 --> 00:25:03,740 And it's so good, and it's so good, 614 00:25:03,740 --> 00:25:04,920 it's gonna happen, big time. 615 00:25:05,600 --> 00:25:07,600 Because, for example, in the case of the comments, 616 00:25:07,800 --> 00:25:10,840 you get so much crap, you don't need that, 617 00:25:10,920 --> 00:25:12,800 and it doesn't happen. 618 00:25:12,800 --> 00:25:13,620 It doesn't have any value for us. 619 00:25:13,860 --> 00:25:15,800 Like, for example, in comments, you can also find code. 620 00:25:17,200 --> 00:25:18,160 We don't want that. 621 00:25:18,300 --> 00:25:20,260 We don't get pretty much any, any result for that. 622 00:25:20,460 --> 00:25:22,400 If we're going to do more, like, sentiment analysis 623 00:25:22,400 --> 00:25:24,960 or anything like that, or, it's not gonna help. 624 00:25:25,840 --> 00:25:29,620 Some code statements, nothing I can use. 625 00:25:30,000 --> 00:25:32,500 We also have, there's a lot of bad characters, 626 00:25:32,840 --> 00:25:36,280 like dollar sign, equal, and all that stuff. 627 00:25:36,520 --> 00:25:37,460 We should remove that. 628 00:25:37,560 --> 00:25:39,040 It's the same when we do Twitter analysis. 629 00:25:39,320 --> 00:25:41,840 Usually remove the hashtag and all that stuff. 630 00:25:42,360 --> 00:25:42,780 Okay. 631 00:25:42,800 --> 00:25:43,420 It's the same thing. 632 00:25:43,580 --> 00:25:45,200 So, and also when I was looking around, 633 00:25:45,540 --> 00:25:48,180 there's just a lot of useless text. 634 00:25:48,880 --> 00:25:50,460 Especially with license. 635 00:25:51,360 --> 00:25:53,480 People put all their license in their source code, 636 00:25:54,060 --> 00:25:55,040 and doesn't give me anything, 637 00:25:55,140 --> 00:25:57,340 because that code is not from the developer, 638 00:25:57,540 --> 00:25:58,420 so I don't need that. 639 00:25:59,000 --> 00:26:01,900 And we can see a lot of that into source code. 640 00:26:02,060 --> 00:26:03,800 So that's things, so right now, 641 00:26:06,240 --> 00:26:07,780 something we have to improve a lot, 642 00:26:07,900 --> 00:26:10,280 because I've been writing some tools and stuff, 643 00:26:10,360 --> 00:26:12,160 but this isn't much work, 644 00:26:12,160 --> 00:26:14,640 or to be done, because there's so much stuff 645 00:26:14,640 --> 00:26:15,860 in the comments I don't need, 646 00:26:15,980 --> 00:26:19,080 so right now, it's something we have to improve. 647 00:26:19,260 --> 00:26:22,480 How to get comments that I can really use. 648 00:26:25,100 --> 00:26:26,660 So, for example, in here, 649 00:26:30,980 --> 00:26:33,040 for the comment, for example, we have here, 650 00:26:33,820 --> 00:26:35,620 I don't know, let's see. 651 00:26:38,520 --> 00:26:41,880 For example, we're gonna do, this is one of the tools I use. 652 00:26:44,460 --> 00:26:45,540 Tools, projects. 653 00:26:50,100 --> 00:26:52,660 Let's do, I don't know, which one. 654 00:26:53,700 --> 00:26:54,620 Nmap I guess. 655 00:26:55,820 --> 00:26:56,380 C. 656 00:26:58,840 --> 00:27:01,520 And now, this, excuse me, 657 00:27:03,500 --> 00:27:06,580 course, because I didn't do the slash B. 658 00:27:08,860 --> 00:27:11,880 Nope, okay, now what the tool did, it created, 659 00:27:11,880 --> 00:27:16,720 I did a, oh, something wrong there, ah, okay, my bad. 660 00:27:18,720 --> 00:27:19,300 Okay, there. 661 00:27:20,000 --> 00:27:22,540 So what I did is I used a small tool I wrote, 662 00:27:22,700 --> 00:27:24,320 and that tool I have to improve a lot. 663 00:27:25,020 --> 00:27:27,700 But now it's going to the repo, I download it, 664 00:27:27,780 --> 00:27:29,680 and I'm telling, look for C files, 665 00:27:29,900 --> 00:27:31,140 and pull out all the comments. 666 00:27:31,680 --> 00:27:35,860 So yeah, so as you can see, there's so much stuff there. 667 00:27:36,300 --> 00:27:38,640 It's not like Twitters, like if you go to tweet, 668 00:27:38,700 --> 00:27:39,860 you can start downloading all the tweets, 669 00:27:39,860 --> 00:27:42,980 and take those tweets, and analyze them. 670 00:27:43,060 --> 00:27:44,280 Here we have to do a lot of cleaning. 671 00:27:44,560 --> 00:27:46,500 And that's a thing I'm working, 672 00:27:46,680 --> 00:27:48,640 but there's much more work to do, 673 00:27:48,700 --> 00:27:51,560 because you can see we have so much stuff 674 00:27:51,560 --> 00:27:53,080 that doesn't mean anything. 675 00:27:53,220 --> 00:27:54,360 For example, we have a license here, 676 00:27:54,660 --> 00:27:56,060 so we have to remove that. 677 00:27:56,400 --> 00:27:58,820 So there's a lot of data cleaning we have to perform 678 00:27:58,820 --> 00:28:03,620 to really get some information I can use, 679 00:28:03,680 --> 00:28:05,320 or get a feeling of the developers. 680 00:28:06,100 --> 00:28:08,880 So yeah, so that's a work in progress. 681 00:28:09,860 --> 00:28:12,340 Just to give you an idea what things we have to do, right? 682 00:28:13,120 --> 00:28:15,000 And you can see this, yeah, numbers here, 683 00:28:15,200 --> 00:28:17,820 probably doesn't mean, doesn't have any value for me. 684 00:28:17,940 --> 00:28:19,800 Yeah, so sometimes you can see comments 685 00:28:19,800 --> 00:28:21,220 that are really interesting, 686 00:28:21,940 --> 00:28:24,640 but I don't know if I can find any of those right now. 687 00:28:24,700 --> 00:28:27,180 But yeah, just looking around, so that takes time. 688 00:28:27,400 --> 00:28:30,400 So this, right now is a bit manual process. 689 00:28:31,260 --> 00:28:33,880 We have to start, usually what I do is 690 00:28:33,880 --> 00:28:35,860 I pull all these to a CVS, 691 00:28:35,960 --> 00:28:38,280 and then I can open with different tools, 692 00:28:38,420 --> 00:28:39,500 and start removing. 693 00:28:39,860 --> 00:28:42,960 Some things, but it's quite time consuming at the moment, 694 00:28:43,080 --> 00:28:43,200 right? 695 00:28:43,800 --> 00:28:47,060 If anyone have a good idea to manage this, perfect. 696 00:28:47,560 --> 00:28:48,240 Just let me know. 697 00:28:48,720 --> 00:28:51,460 I'm working on different things to speed up this process, 698 00:28:51,640 --> 00:28:53,880 but right now it's a bit time consuming. 699 00:28:54,160 --> 00:28:55,420 Well, data cleaning is what we say. 700 00:28:55,540 --> 00:28:57,900 Even in data science, and everyone familiar with that, 701 00:28:58,060 --> 00:29:00,540 it's a hard process, right? 702 00:29:00,860 --> 00:29:02,400 Not everything can be optimized. 703 00:29:02,740 --> 00:29:03,580 It's hard sometimes. 704 00:29:04,000 --> 00:29:04,400 Okay. 705 00:29:05,060 --> 00:29:08,880 As you can see, we can get so much comments and stuff. 706 00:29:08,880 --> 00:29:11,700 The only thing, we have to find information we want there. 707 00:29:11,980 --> 00:29:13,780 There's chances that we can find something 708 00:29:13,780 --> 00:29:17,100 that can be used, but we have to find it first. 709 00:29:17,440 --> 00:29:19,700 But at least we start narrow things, right? 710 00:29:19,820 --> 00:29:20,660 I use source code. 711 00:29:20,840 --> 00:29:22,600 Now from the source code, I'm getting comments. 712 00:29:22,760 --> 00:29:23,640 Now I can start. 713 00:29:24,060 --> 00:29:26,640 I'm just narrowing the information I want. 714 00:29:27,860 --> 00:29:28,300 Okay. 715 00:29:28,720 --> 00:29:31,500 So you can see there's a lot of comments here and stuff. 716 00:29:31,700 --> 00:29:36,000 So just being there and taking some time 717 00:29:36,000 --> 00:29:37,220 to see what's going on. 718 00:29:37,360 --> 00:29:37,960 Okay. So that. 719 00:29:37,960 --> 00:29:42,080 We can find some interesting things in the comments. 720 00:29:42,320 --> 00:29:45,020 But let's move on, and hopefully it will be more interesting. 721 00:29:46,020 --> 00:29:48,760 So another tool, I developed this tool. 722 00:29:48,820 --> 00:29:50,200 It's a source code intelligence tool. 723 00:29:50,360 --> 00:29:52,140 I use this tool to compile projects. 724 00:29:53,800 --> 00:29:56,620 What I do is an analyzer there. 725 00:29:57,120 --> 00:29:58,680 It's a tool that runs inside GCC. 726 00:29:58,840 --> 00:29:59,920 When you are building projects, 727 00:30:00,080 --> 00:30:02,160 it will pull out intelligence from the source code. 728 00:30:02,260 --> 00:30:04,400 So all it works in GCC and for C code. 729 00:30:05,740 --> 00:30:07,080 But at the same time, 730 00:30:07,080 --> 00:30:10,100 I'm starting putting, so now has become a framework. 731 00:30:10,280 --> 00:30:14,540 So I'm adding more tools into the framework 732 00:30:15,040 --> 00:30:18,400 called Profanity and Ausinter there. 733 00:30:18,640 --> 00:30:22,860 So Profanity, we look for bad words in the code. 734 00:30:23,080 --> 00:30:25,920 And Ausinter, we look for open source intelligence patterns 735 00:30:25,920 --> 00:30:26,780 in the source code. 736 00:30:26,880 --> 00:30:30,600 And those two are completely language agnostic. 737 00:30:30,820 --> 00:30:32,720 It will go for the files. 738 00:30:33,060 --> 00:30:35,920 Analyzer has to be running inside GCC for C code. 739 00:30:35,920 --> 00:30:39,760 But Ausinter and Profanity is completely agnostic. 740 00:30:39,960 --> 00:30:42,400 So those are the tools we're gonna start using 741 00:30:42,400 --> 00:30:43,460 to get some information. 742 00:30:46,160 --> 00:30:47,520 Okay, so for the functions, 743 00:30:49,740 --> 00:30:51,640 so I'm not gonna run them because, 744 00:30:51,800 --> 00:30:53,520 well, Profanity is not that, 745 00:30:55,060 --> 00:30:56,340 Profanity is more or less fast 746 00:30:56,340 --> 00:30:58,820 depending on the size of the code, of the code base. 747 00:30:59,560 --> 00:31:02,040 But Ausinter takes quite a lot to run. 748 00:31:02,200 --> 00:31:03,740 So I will skip that. 749 00:31:03,900 --> 00:31:05,900 I've already run it. 750 00:31:05,900 --> 00:31:08,180 I'll run them in several reports to get some results. 751 00:31:09,120 --> 00:31:13,700 So for example, let's do the DOOM as a Profanity. 752 00:31:16,060 --> 00:31:18,400 So what I did is I run a Profanity tool 753 00:31:18,400 --> 00:31:20,860 and create a JSON file with all the bad words. 754 00:31:21,020 --> 00:31:24,100 And now I use another tool inside the framework 755 00:31:24,100 --> 00:31:25,360 to generate a report. 756 00:31:26,260 --> 00:31:33,040 And this is the DOOM source code from the game, right? 757 00:31:33,040 --> 00:31:37,240 And we can start seeing some words there, right? 758 00:31:37,420 --> 00:31:41,180 So don't get offence if you see something there. 759 00:31:41,460 --> 00:31:44,740 So yeah, we can see there is hello.sac, 760 00:31:44,920 --> 00:31:47,440 fuck, shit, ass, bastard, 761 00:31:49,680 --> 00:31:51,120 sex, asshole, I don't know. 762 00:31:51,200 --> 00:31:53,020 You go there to the, and sometimes, 763 00:31:53,520 --> 00:31:55,420 sometimes you go there and check this. 764 00:31:55,500 --> 00:31:57,860 The file, maybe you can find a comment there 765 00:31:57,860 --> 00:32:00,860 that somebody, sometimes they talk about somebody else 766 00:32:00,860 --> 00:32:01,380 in the company. 767 00:32:01,660 --> 00:32:02,640 . Or, 768 00:32:02,640 --> 00:32:04,440 Or this code sucks, and actually sometimes 769 00:32:04,440 --> 00:32:07,600 this code sucks because it's hard, 770 00:32:07,820 --> 00:32:10,480 or they have a bug or whatever, 771 00:32:10,720 --> 00:32:11,940 so that's also convenient for us. 772 00:32:14,680 --> 00:32:18,080 No, right now I'm using two dictionaries, 773 00:32:18,180 --> 00:32:21,600 English, and I was just looking for English and Spanish, 774 00:32:22,320 --> 00:32:26,080 but in the Tintorella, there's dictionaries 775 00:32:26,080 --> 00:32:30,220 for, I think, 15 languages, from Chinese, 776 00:32:30,460 --> 00:32:31,660 I don't know, there's a lot. 777 00:32:31,660 --> 00:32:33,260 The only thing is, for speed, 778 00:32:33,580 --> 00:32:35,620 because I was only interested in English and Spanish, 779 00:32:35,820 --> 00:32:38,680 I removed all of them, but you download the tool, 780 00:32:38,740 --> 00:32:39,540 you have all the dictionaries. 781 00:32:39,860 --> 00:32:41,740 The only thing is, it takes a bit longer to run, 782 00:32:41,860 --> 00:32:43,720 because you're looking at all the words. 783 00:32:44,080 --> 00:32:45,920 Yeah, but it's pretty much, yeah, I mean, 784 00:32:45,940 --> 00:32:48,460 this is a, it was a U.S. company, it's in Texas. 785 00:32:49,620 --> 00:32:51,180 So yeah, they were pretty much, 786 00:32:51,260 --> 00:32:52,800 so I guess all the bad words are in English, 787 00:32:52,900 --> 00:32:53,360 that makes sense. 788 00:32:55,860 --> 00:32:57,440 Yeah, so there is a bunch of there, 789 00:32:57,860 --> 00:33:00,600 and the funny thing is, I guess when things 790 00:33:00,600 --> 00:33:01,560 are moving forward, 791 00:33:01,660 --> 00:33:03,660 the things are getting nastier, 792 00:33:03,780 --> 00:33:05,700 because this is the code for the Doom, 793 00:33:06,960 --> 00:33:08,960 for the Doom, and as you can see, 794 00:33:09,060 --> 00:33:09,860 they are not that much. 795 00:33:11,160 --> 00:33:14,260 So okay, that's okay, actually, 796 00:33:14,360 --> 00:33:15,580 in terms of bad words. 797 00:33:15,900 --> 00:33:18,460 If you go to, for example, Quake 3, 798 00:33:24,200 --> 00:33:26,820 from the same people, and that's, 799 00:33:28,060 --> 00:33:30,360 so you can see, actually, there are, yeah, 800 00:33:30,440 --> 00:33:31,400 there's a lot of X there, 801 00:33:31,660 --> 00:33:36,480 but there are more, yeah, so there's a bunch of words, 802 00:33:36,560 --> 00:33:37,480 so there are more, actually. 803 00:33:37,900 --> 00:33:39,940 So this is a newer game, but the newer game 804 00:33:39,940 --> 00:33:43,240 is seven years old, but they use more bad words 805 00:33:43,240 --> 00:33:44,520 in the game than before, right? 806 00:33:44,800 --> 00:33:47,100 So I guess there are more stress, I don't know. 807 00:33:48,880 --> 00:33:49,880 Hardcore, I don't know. 808 00:33:49,980 --> 00:33:52,040 When you start looking at those files, 809 00:33:52,140 --> 00:33:54,140 it's very funny to see where that word is, 810 00:33:54,220 --> 00:33:56,140 and what they're saying, what are they saying there. 811 00:33:56,500 --> 00:33:59,160 So that started giving me a feeling about these guys. 812 00:34:05,500 --> 00:34:06,580 Yeah, that was funny. 813 00:34:06,760 --> 00:34:08,560 Actually, you go to there, to the caster fact, 814 00:34:08,720 --> 00:34:10,100 that one, I look it up, because I say, 815 00:34:10,120 --> 00:34:10,700 what's going on here? 816 00:34:10,940 --> 00:34:12,660 Actually, it's a function there, 817 00:34:12,840 --> 00:34:14,760 and they say, this function is a caster fact. 818 00:34:14,960 --> 00:34:16,040 It has to be fixed. 819 00:34:16,800 --> 00:34:18,060 So when I'm looking for vulnerabilities, 820 00:34:18,260 --> 00:34:19,640 that's a place I will go, that's for sure. 821 00:34:26,400 --> 00:34:28,740 Okay, so that was a profanity to do, right? 822 00:34:28,900 --> 00:34:29,960 So, okay, that's, 823 00:34:31,120 --> 00:34:31,640 so that's, 824 00:34:31,640 --> 00:34:33,500 that's why now is to start looking and get a feeling, right? 825 00:34:34,380 --> 00:34:35,400 So now we can do, 826 00:34:35,800 --> 00:34:38,520 actually, there was another thing I did before. 827 00:34:38,960 --> 00:34:40,220 Let me, actually, 828 00:34:41,240 --> 00:34:41,600 so, 829 00:34:41,980 --> 00:34:44,780 so what I did is I started taking some of the developers 830 00:34:44,780 --> 00:34:45,480 of these reports, 831 00:34:47,600 --> 00:34:49,020 so I was looking at these reports, 832 00:34:49,580 --> 00:34:50,680 I didn't show you, 833 00:34:50,720 --> 00:34:51,620 for example, TensorFlow, 834 00:34:51,900 --> 00:34:53,920 you guys familiar with Google Framework? 835 00:34:54,080 --> 00:34:56,760 And actually, there's pretty much no bad words in TensorFlow, 836 00:34:57,040 --> 00:34:58,860 and the code base is huge, 837 00:34:59,000 --> 00:35:00,880 so I don't know if the people in Google are nice, 838 00:35:00,920 --> 00:35:01,320 or they are, 839 00:35:01,640 --> 00:35:02,520 they don't have some kind of bad word policy. 840 00:35:02,680 --> 00:35:04,760 I don't know, but I was surprised about that. 841 00:35:04,880 --> 00:35:06,060 It's a huge code base, 842 00:35:06,140 --> 00:35:07,580 and pretty much there's no bad words. 843 00:35:07,800 --> 00:35:10,340 So I don't know if there's some policy or not. 844 00:35:10,620 --> 00:35:11,720 But, for example, looking at those, 845 00:35:11,900 --> 00:35:14,380 what I did here is I downloaded, 846 00:35:14,680 --> 00:35:19,460 those are the tweets from several developers, 847 00:35:20,920 --> 00:35:22,700 and I did, I downloaded the tweets, 848 00:35:22,820 --> 00:35:25,780 and I submitted to Sentiment Analysis API 849 00:35:25,780 --> 00:35:28,380 to give me a feeling of this guy's, of the angriness. 850 00:35:28,640 --> 00:35:30,680 Can you guys guess who is the most angry person here? 851 00:35:36,760 --> 00:35:37,240 No. 852 00:35:38,760 --> 00:35:39,500 No guess there? 853 00:35:43,000 --> 00:35:43,820 Excuse me, who? 854 00:35:44,860 --> 00:35:45,340 Who? 855 00:35:46,040 --> 00:35:46,520 Carmack. 856 00:35:47,160 --> 00:35:48,120 Actually, that's right. 857 00:35:48,200 --> 00:35:49,220 That's the own Carmack, 858 00:35:49,220 --> 00:35:51,360 that's the developer of Doom and Quake. 859 00:35:52,700 --> 00:35:53,640 You go downstairs, 860 00:35:53,820 --> 00:35:54,840 so those are all the tweets, 861 00:35:55,040 --> 00:35:58,340 and that's very easy to do with Python script, 862 00:35:58,560 --> 00:36:01,240 and take the tweets and submit it to an API for analysis, 863 00:36:01,680 --> 00:36:03,980 and it's free, actually, so that's, I always do that. 864 00:36:05,420 --> 00:36:07,740 So here you go to, so now I have some statistics, 865 00:36:07,960 --> 00:36:09,300 so let me move that there. 866 00:36:09,820 --> 00:36:11,260 So yeah, we can see, actually, 867 00:36:11,380 --> 00:36:14,060 this guy is more negative than positive. 868 00:36:15,060 --> 00:36:16,200 So that's quite interesting, 869 00:36:17,160 --> 00:36:20,600 to give me an idea of when I'm profiling this developer. 870 00:36:21,500 --> 00:36:24,300 No wonder there's so much bad words in the games, 871 00:36:24,320 --> 00:36:24,880 in the source code. 872 00:36:26,380 --> 00:36:27,940 So that's quite interesting to do, right? 873 00:36:28,380 --> 00:36:31,560 We have also the VLC, because you know, guys, 874 00:36:31,640 --> 00:36:33,920 VLC, there's also some different type of vulnerabilities there, 875 00:36:34,040 --> 00:36:39,360 so I want to, when I'm looking for vulnerabilities in software, 876 00:36:39,660 --> 00:36:41,680 so it's nice to get a feeling of how these guys are feeling. 877 00:36:44,200 --> 00:36:47,000 Yeah, okay, more or less neutral, okay. 878 00:36:47,560 --> 00:36:49,500 So yeah, you can do those type of things, 879 00:36:49,560 --> 00:36:51,800 just to give me an idea of the developer. 880 00:36:52,120 --> 00:36:53,040 So I think it's quite nice. 881 00:36:56,340 --> 00:36:59,120 And then we have also the open source patterns. 882 00:36:59,680 --> 00:37:01,420 At the end, there's one of the tools, 883 00:37:01,420 --> 00:37:03,020 in the Tintorella framework, 884 00:37:04,140 --> 00:37:05,560 that pretty much do this, 885 00:37:05,840 --> 00:37:09,700 but you can also do it by your own. 886 00:37:11,080 --> 00:37:13,060 So at the end, we will look for IP links, 887 00:37:13,280 --> 00:37:15,560 emails, and different stuff in the source code. 888 00:37:15,720 --> 00:37:17,900 I don't want to go to the Google or anything 889 00:37:17,900 --> 00:37:19,380 to start doing searches at the moment. 890 00:37:19,500 --> 00:37:20,600 I'm looking on the source code. 891 00:37:20,720 --> 00:37:22,340 And you will find a lot of information there, 892 00:37:22,950 --> 00:37:24,620 quite interesting, doing the same thing. 893 00:37:26,180 --> 00:37:28,420 So for example, here, there is a TensorFlow, 894 00:37:28,800 --> 00:37:30,140 the repo in TensorFlow. 895 00:37:31,420 --> 00:37:32,280 There's a regular expression there. 896 00:37:32,500 --> 00:37:34,900 I'm looking for email address. 897 00:37:35,160 --> 00:37:36,800 So now I have a bunch of address. 898 00:37:37,260 --> 00:37:38,920 Of course, I have to do some cleaning there. 899 00:37:39,380 --> 00:37:40,260 That's easy to do. 900 00:37:40,580 --> 00:37:42,900 And now I can take all those email address, 901 00:37:43,120 --> 00:37:45,080 and use all the different other tools, 902 00:37:45,780 --> 00:37:47,120 other tools, open source intelligence, 903 00:37:47,280 --> 00:37:47,920 and put those emails, 904 00:37:48,040 --> 00:37:50,180 and start getting information about it. 905 00:37:50,300 --> 00:37:50,800 So it's quite nice. 906 00:37:52,760 --> 00:37:54,440 And the good thing is, many times, 907 00:37:54,540 --> 00:37:56,360 people in source code, they forget stuff, 908 00:37:56,580 --> 00:37:58,580 they put more links, internal IPs. 909 00:37:59,280 --> 00:38:00,320 So that's quite convenient. 910 00:38:00,480 --> 00:38:01,400 So now I have, so now I have, so now I have, 911 00:38:02,100 --> 00:38:04,060 information about more sensitive information. 912 00:38:04,320 --> 00:38:05,900 The chances of doing Google searches, 913 00:38:06,120 --> 00:38:07,400 I might or might not find them. 914 00:38:09,440 --> 00:38:12,320 Okay, well, that's, some of the queries, 915 00:38:12,540 --> 00:38:14,440 I mean, that's, I don't know. 916 00:38:15,140 --> 00:38:16,980 That's not too excited there. 917 00:38:17,160 --> 00:38:19,980 But that's, for example, I can post those online. 918 00:38:20,300 --> 00:38:21,860 But those are some of the queries I use. 919 00:38:22,060 --> 00:38:24,520 And you can also find them in the tutorial tool. 920 00:38:24,780 --> 00:38:26,440 That one is for look for email address, 921 00:38:29,200 --> 00:38:30,340 IPs, and stuff like that. 922 00:38:30,560 --> 00:38:31,160 So don't worry. 923 00:38:31,160 --> 00:38:31,960 I can post those. 924 00:38:32,160 --> 00:38:33,140 Those are my simple, 925 00:38:34,020 --> 00:38:36,820 right expressions to search for information, right? 926 00:38:37,260 --> 00:38:40,080 Okay, and now, for example, so now I can have links, 927 00:38:40,260 --> 00:38:43,000 IPs, domain names, names of the developers. 928 00:38:44,040 --> 00:38:45,640 So a bunch of information now. 929 00:38:45,840 --> 00:38:47,720 Okay, after some doing some cleaning, 930 00:38:47,880 --> 00:38:51,220 I can start using my regular open source tool 931 00:38:51,220 --> 00:38:54,000 that we all, the open source intelligence tools 932 00:38:54,000 --> 00:38:54,740 we all like, right? 933 00:38:54,780 --> 00:38:56,740 I can start putting those information into Maltego, 934 00:38:56,940 --> 00:38:59,120 Recone NG, Data Spread, and of course, 935 00:38:59,780 --> 00:39:01,140 some custom, you know, some custom, you know, 936 00:39:01,140 --> 00:39:02,020 the scripting tools, right? 937 00:39:02,220 --> 00:39:05,260 I have a bunch of custom tools that I've used. 938 00:39:05,420 --> 00:39:07,080 All this information I get from the source code, 939 00:39:07,220 --> 00:39:10,460 pass it to those scripts. 940 00:39:13,240 --> 00:39:15,980 And now we can just go a regular approach 941 00:39:15,980 --> 00:39:18,180 in the open source intelligence, or send. 942 00:39:18,420 --> 00:39:20,260 So yeah, so from a point of view, 943 00:39:20,300 --> 00:39:21,420 I think a source code is Google, 944 00:39:21,560 --> 00:39:26,580 because many times, people don't pay too much attention. 945 00:39:26,720 --> 00:39:29,460 They just submit to the reports. 946 00:39:29,860 --> 00:39:31,120 So if, so in source code, it's Google, 947 00:39:31,140 --> 00:39:33,880 and in source code, we can find open source intelligence. 948 00:39:34,000 --> 00:39:36,740 We can find email, links, IPs, and stuff like that. 949 00:39:37,000 --> 00:39:38,780 We can sometimes find sensitive information. 950 00:39:39,080 --> 00:39:42,200 People forget tokens, credentials, and stuff like that. 951 00:39:43,540 --> 00:39:45,360 So we can actually, so that's nice. 952 00:39:45,840 --> 00:39:47,860 We can also do comments and sentiment analysis. 953 00:39:48,200 --> 00:39:50,060 We have to do a lot of cleaning on the comments, 954 00:39:50,140 --> 00:39:51,220 but we can still do some, 955 00:39:51,220 --> 00:39:53,420 so get a feeling of the developers, 956 00:39:53,640 --> 00:39:55,080 and of course we can also find more of these. 957 00:39:55,260 --> 00:39:57,580 So yeah, so in my opinion, source code is really nice. 958 00:39:58,120 --> 00:39:59,260 It's a gold mine. 959 00:39:59,420 --> 00:40:00,160 The only thing is, 960 00:40:00,160 --> 00:40:01,760 we have to harvest that. 961 00:40:02,500 --> 00:40:06,160 And of course, from talking with people, 962 00:40:06,380 --> 00:40:08,000 yeah, there's a lot of, I was mentioning before, 963 00:40:08,320 --> 00:40:10,120 there's a lot of, there are several companies 964 00:40:10,120 --> 00:40:12,160 doing content intelligence and stuff like that. 965 00:40:12,280 --> 00:40:15,880 They put fake data in social networks and other stuff 966 00:40:15,880 --> 00:40:18,940 to make open source intelligence harder. 967 00:40:19,440 --> 00:40:22,080 But core reports at this time, from my understanding, 968 00:40:22,140 --> 00:40:24,440 people don't pay so much attention. 969 00:40:24,760 --> 00:40:27,780 So we can go to the reports and start getting info 970 00:40:27,780 --> 00:40:29,340 without going to the social network, 971 00:40:29,480 --> 00:40:33,160 without making any attention to go to the social network, 972 00:40:33,280 --> 00:40:33,640 for example. 973 00:40:33,880 --> 00:40:36,020 And pretty much we can get a lot of information as well. 974 00:40:36,500 --> 00:40:38,460 So yeah, so source code is gold. 975 00:40:39,920 --> 00:40:43,100 So next steps, there's a lot of work to be done. 976 00:40:43,480 --> 00:40:46,620 So yeah, we have to, for sure we have to do some, 977 00:40:47,840 --> 00:40:49,560 actually, when we're talking, I don't know, 978 00:40:49,620 --> 00:40:50,460 let's see, I don't know. 979 00:40:51,300 --> 00:40:54,620 I was talking with Data Spirit, 980 00:40:54,900 --> 00:40:57,520 and actually they were saying that they want to also 981 00:40:57,520 --> 00:41:00,060 add some stuff like this into Data Spirit. 982 00:41:00,240 --> 00:41:02,000 I think that's quite nice, right? 983 00:41:02,300 --> 00:41:05,500 So yeah, so we have to improve this field, I guess. 984 00:41:05,640 --> 00:41:08,640 So we need more improvement tools, that's for sure, 985 00:41:08,780 --> 00:41:11,140 and more optimization, that's for sure. 986 00:41:11,400 --> 00:41:13,140 For the comments, there's a lot of, 987 00:41:13,820 --> 00:41:16,320 with the clean up analysis and classification 988 00:41:16,320 --> 00:41:18,060 of the comments, so that's quite nice. 989 00:41:18,320 --> 00:41:22,300 And I didn't go too much into the developer profiling, 990 00:41:22,340 --> 00:41:23,280 but I'm still working on that. 991 00:41:23,460 --> 00:41:25,300 And the idea is you take source code 992 00:41:25,300 --> 00:41:27,220 and look in different type of parameters, 993 00:41:27,300 --> 00:41:27,500 and then you go to the source code, and look in different type of parameters, 994 00:41:27,520 --> 00:41:31,440 I can give you an idea of profiling the developer, 995 00:41:31,940 --> 00:41:36,400 looking for how he writes, what's his style of coding, 996 00:41:36,560 --> 00:41:40,920 and we can find similar coding of the developer in other places. 997 00:41:41,360 --> 00:41:44,020 So that's developer profiling, and that's an interesting field. 998 00:41:44,340 --> 00:41:47,180 But it's not, it's more or less related, 999 00:41:47,340 --> 00:41:48,200 but it's another thing. 1000 00:41:48,380 --> 00:41:49,600 So yeah, so these are the things 1001 00:41:49,600 --> 00:41:51,560 we still have to improve in this thing. 1002 00:41:51,680 --> 00:41:53,820 And of course, we should start adding 1003 00:41:53,820 --> 00:41:56,620 or Data Spirit or Rekon NG or other tools, 1004 00:41:57,260 --> 00:41:59,560 start adding these source code analysis 1005 00:41:59,560 --> 00:42:02,020 and get information into those tools. 1006 00:42:02,760 --> 00:42:07,260 So yeah, that's, so I think that's pretty much the talk. 1007 00:42:07,360 --> 00:42:08,600 I don't know how I am in time. 1008 00:42:08,800 --> 00:42:09,820 I'm good or not? 1009 00:42:09,960 --> 00:42:11,020 Or what time is it? 1010 00:42:11,180 --> 00:42:11,660 I don't know. 1011 00:42:11,740 --> 00:42:12,180 I'm okay. 1012 00:42:12,540 --> 00:42:14,960 So you guys have any questions, comments? 1013 00:42:15,640 --> 00:42:16,260 Yes, please. 1014 00:42:16,520 --> 00:42:19,500 I noticed that you posted the source code 1015 00:42:19,500 --> 00:42:20,340 as a zip file. 1016 00:42:21,200 --> 00:42:21,680 Yes. 1017 00:42:21,920 --> 00:42:24,600 And you can't run your code against your code. 1018 00:42:25,160 --> 00:42:26,100 Yeah, that's the point. 1019 00:42:26,120 --> 00:42:26,600 Yeah, that's the point. 1020 00:42:26,620 --> 00:42:29,500 That's called, that's open source ops. 1021 00:42:30,900 --> 00:42:33,460 No, that's, yeah, yeah, yeah, I know, I know. 1022 00:42:33,540 --> 00:42:34,600 I have to fix that, yeah. 1023 00:42:35,300 --> 00:42:35,700 Yeah. 1024 00:42:39,500 --> 00:42:41,200 You guys have any more questions? 1025 00:42:41,320 --> 00:42:43,060 If you guys want to talk about open source intelligence 1026 00:42:43,060 --> 00:42:45,100 or something like that, probably I will be in the bar 1027 00:42:45,100 --> 00:42:48,220 in the afternoon, so come and grab me for a beer 1028 00:42:48,220 --> 00:42:49,760 and we can talk some. 1029 00:42:50,100 --> 00:42:51,620 You guys have any more questions? 1030 00:42:51,840 --> 00:42:51,960 No? 1031 00:42:52,060 --> 00:42:52,520 Thanks a lot. 1032 00:42:52,580 --> 00:42:53,660 It's been a pleasure being here. 1033 00:42:54,900 --> 00:42:55,960 And no, thanks. 1034 00:42:56,200 --> 00:42:56,600 Thank you. 1035 00:42:56,620 --> 00:42:58,020 Thank you.