Good afternoon. It's nice to be here.
How's it going in DEF CON so far?
You guys enjoying it?
Awesome!
So, yeah, so when
when we're thinking about the RECON
I used to do a lot of
open source intelligence
so I thought, okay, let's
take another approach.
Of course we will go to the social networks
and all that stuff, but let's try to get
information from source code.
And that's the idea of this talk
to give you some tips.
So that will be the talk.
We will see.
So my name is Samuel Roses. I'm founder of
Bullnex. Bullnex is a startup back in
Spain. I used to work at Microsoft
in the security team, but now
I'm doing my own thing. I also won
a DARPA, a US DARPA, so I went here
I was invited here to the Pentagon
so it was quite an interesting experience for me
being a foreign.
I usually go to many conferences and talk
and so that's pretty much
everything.
So the objective of the talk
are you guys hearing me fine?
Okay. If I cough or anything, sorry about that
because I'm a bit cold.
Today I'm feeling better, but yesterday and Thursday
I was miserable.
But now hopefully I'm fine.
So I will talk a little
about some basic
source code analysis. It will be quite basic.
We will not go into too much detail
how to do that. And then it will be more
open source intelligence tactics.
Stuff we are looking
for. So I'm sure most of you are familiar
with those.
So how we can apply those to source code.
So the agenda will be like an introduction.
We will cover what we're going to achieve and why.
We will start doing some open source intelligence
on some developers and the source code.
And then we will do some conclusions.
Yeah, this is something I've been working.
So this is work in progress and I thought, okay, let's go.
Let's go to the Raccoon Village in DEF CON
and show some ideas I'm working on.
And hopefully people will have a nice discussion
after some beers. That always helps.
And how we can improve this.
I think it's quite a new field.
I haven't seen much people talking
how to do open source intelligence
in source code and also how to do
developer profiling and all that stuff
in source code.
There's some research on that, but still
it's an interesting field to get into.
So I'm going to talk a little bit about that.
So, okay, so I will show you what I'm working on,
but I'm sure there's much more things we can do.
So hopefully people can come up with some nice ideas
and we can improve those.
So introduction.
I mean, I guess most of you are familiar with that, right?
It was one of the famous Stephen Ballmer.
When he was in Microsoft, not anymore,
but when he was there, he gave a speech there
and I haven't seen him.
I haven't seen him in person
and he's always like energy.
Quite insane, actually, but funny.
And here's one of the famous talks he was giving
and he was saying developers, developers, developers, right?
Of course, in Microsoft, it's one of the best,
most important things, right?
In the company, the NSS software company.
So for many companies, it's the same, right?
So, yeah, in this case, we think we will target,
the idea is to target developers.
We're going to get information through the developers.
Why developers?
I mean, I'm a developer myself,
so I think it's quite interesting, right?
Of course, this is only applied to companies
who develop software, right?
If the company doesn't have any developers,
this is not going to help,
but there are more and more companies
having their own developer staff, right?
So most of the time, developers are really technical people,
but not security savvy.
That's true.
I know a lot of, when there are really good developers,
they are not into too much security.
So that's perfect for us.
When we are doing open source intelligence,
we can take some benefit there.
And also developers, from my point of view,
of course, I'm a developer and I do a few things,
so I guess I'm not, I'm biased for that,
but I guess, but in most companies,
okay, there are no, like, decision makers most of the time,
but quite often, there are infuers.
So they can,
they help high management where we should go,
so there are people,
so those guys are influencers,
so that's good.
They have some certain power in the company.
Perfect.
And also they usually have access to information and systems,
so that's perfect.
They can go to,
they have maybe access to information or systems
that other people in the company don't have.
Sometimes they have too much information
because they are developing and they,
okay, I need,
I need,
I need full access to the system.
Well, you don't need that,
but most companies, okay, you get everything.
So that's perfect.
So, okay, that's quite convenient for us.
And of course, there are habits there, right?
I mean, you guys are developers, you know,
we love science fiction.
Who doesn't, right?
If you don't, you are in the wrong room, I guess.
Anime, a lot of people go for anime.
Porn, I mean, of course, right?
Not only developers, I guess,
but that's something we can explain.
And of course, beer, right?
That's something that developers love.
And we can benefit, I mean, we can expect that, right?
And we are getting information,
and then we are going to do more, like,
social engineering attacks.
I'm not going to talk about social engineering attacks here
because that's not what I want.
But after I pull out all the information I need,
I can, I know information about developers,
and I can focus on those areas that chances are
I will be able to attract his attention
through these habits.
And that's quite common to see that.
So, methodology, I like to follow.
Instead of just going, for example,
I have to target a company, right?
We usually start with the domains, the IPs.
Maybe, hopefully, I can do some Google searches,
try to find some emails, and stuff like that.
That's usually, most of us start, right?
Okay, so the way I went is,
okay, I have to target a company.
At this point, I don't know anyone.
I don't know anyone there, but hopefully,
I can go and check if they have any GitHub reports
or something like that.
Okay, so let's go to the reports
and start downloading those.
So, I will start downloading the reports,
the code reports, and now,
the GitHub is a huge thing these days, right?
So, that's the place I will go to start there.
And then I will start looking for open source patterns in code.
So, I will do some of the things I usually do
in Google searches and stuff like that,
but applying it to source code.
And after that, I have a bunch of information there.
Of course, I will go more traditional way
with social networks and different tools and stuff, right?
So, that's the way I'm going with this.
Of course, things we can look at,
we can search in the patterns.
We can start searching in the code, right?
We have some of the classic things.
Usually, we do in Google searches
or with different tools, right?
We look for APIs,
Domain names, URLs, emails, credit cards,
maybe in source code sometimes, phone numbers.
We can also find phone numbers.
So there's a bunch of different information there
we can start pulling out in source code.
Usually, I've been doing code reviews for a long time.
So actually, now these days,
people are starting to put in more comments
and nicer in the source code,
and that's quite nice for us.
If you start looking at old code,
pretty much there's no comments or anything.
So for us right now,
most modern code is quite perfect.
And actually, things we can start looking into
in source code as well is Twitter alias.
That's not so common.
Actually, when you go to the GitHub report,
people usually put the alias there,
so it's perfect.
Now I have that information.
I can start doing more things.
But usually in the source code,
I haven't seen so often.
People usually, they put their name
and their name on the source code.
And maybe the email,
but not so often the Twitter alias.
But that's something we should start looking at.
And of course, the comments.
It depends how well people write their comments
and in detail and stuff like that.
But sometimes we can also find
some interesting piece of information in the comments.
So that's the thing I will start looking into source codes.
So, right, give me a source code.
Right?
So usually we don't have any documentation.
I don't care about that.
In this case, usually when you ask,
when I do code reviews,
I usually ask for documentation,
but usually they don't give me any.
So I'm used to the real code.
So in this case, it's perfect.
In this case, we download the repos.
And now we have to focus on the source code.
So yeah, we will start reading the source code.
I mean, it doesn't mean,
it doesn't need,
actually we don't need to really read the source code.
We will do some search there,
so we don't have to go through the code.
It's up to you.
It depends what you're looking for.
And here we can start some examples, right?
Here we have,
we start doing some,
for example, I have here a target.
It can be a person, a company,
but now, for example,
look at this.
This is the header.
I'm opening this program.
This is the American Fuzzy Lab.
It's a fuzzer,
a very popular fuzzer.
Okay, so just looking by the header,
that's quite common,
that people write headers into the source code.
It's a C program.
As you can see at the end,
flanalyze.c.
It's a C program.
But now, for example, here,
for example, I'm supposed to target this company,
whatever.
But now I have like three pieces of information.
I can start work.
So I downloaded this repo,
and now I know, for example,
I have a name,
I have an email address,
and I have a company.
So from this,
I just got three pieces of information.
Now I can, okay,
I can start getting that,
that information.
I can start working,
going and get more,
more info.
So for just looking at the header,
now I have three things.
By just downloading this code,
I can start,
I can start applying more techniques.
Same here.
Now I have downloaded the AirCag,
AirCag source code,
and again,
I have actually,
and now it's the same.
I have several pieces of information
that are quite interesting.
There's a,
we can see there's somebody,
Christopher started in 2004, 2005,
how he started the project,
but now Thomas has taken over.
So we can see there's a relationship.
Those two guys have been working on the same project,
and one of them took the over.
Okay, that's,
we're starting to create relationships.
So that's interesting.
You guys know,
in social networks and stuff like that,
we do a lot of relationship analysis.
So now we're starting making relationships there.
And right now,
I'm doing this in my mind,
but we can start writing that down.
And that's how we can see this,
there's more people there that are mentioned.
So I have more names.
So I can start linking,
okay, there's people in the relationship.
Then maybe I can go to social,
different social networks,
and start seeing they are following each other,
or what they say,
they are friends or not.
So I'm here starting relationships.
They want to move other type of,
like social media attacks or whatever.
Probably with these guys,
it's not gonna work,
but that's just an example, right?
But that's the way I will start.
So, okay,
so now we have starting names.
Names and relationships,
so that's good.
So now we have some information I can start work with.
So I guess some tools, right?
At the end, it's all about the tools, right?
So in this case,
I'm gonna cover some different tools we can start using.
There are many more,
but I guess some of the most I use,
and I'm sure in time I will add more.
That's for sure.
And some of the tools I'm using
have to improve a lot as well.
So, but at least we,
so, but there are some tools we can start using right away.
So I think they are nice.
Okay, one of the first tool I like is githubrank.com.
And it's a nice tool to give you a ranking
of the different reports in GitHub.
So we can, for example, this is,
I told, I gave me the rank of all the top,
top for GitHub in relative to C language.
Of course, the first one is a Linux source code,
and we hear Tor Wells there, right?
So that's quite interesting.
And this site can tell me to start getting,
if I'm looking for particular reports,
I can see how popular they are,
and people are downloading, or stuff like that.
So, okay, that's a good start
to get a feeling of the popularity of this report.
It doesn't, it doesn't make sense here.
I'm targeting a company to look for open source intelligence,
and I start looking for reports that doesn't have any,
any value, I'm just wasting my time.
So yeah, that's a good way to start
to get some feeling of the popularity of the report.
Okay, cool.
So you can see there's a lot of interesting stuff there.
Another tool I like is githubwrap.
Anyone familiar with this tool?
That was released a couple of years ago.
Actually, the tool,
the idea of the tool is to
reconnaissance github repos for private keys
and credentials and stuff like that.
But it gives you more information we can use
for a more open source intelligence approach.
So the tool looks for credentials and private keys
and different stuff.
So it's quite nice to use
for our purpose, to start.
And this is the tool.
It will go to a repo, and start downloading those repos
and the users and some information
that's quite interesting for me.
So this is the UI of the tool.
It's a web application.
So it's quite nice.
So let me show you.
Okay, let's go there.
I have it running here locally.
Let me show you.
Come on, come on.
Ah.
Because I don't have any connections,
it's time to connect outside.
So we'll timeout.
Well, actually, hopefully when it's timeout,
they will give me the images.
The tool, what it does, it will start showing,
this is a different repos of,
usually the way it works, you will give the tool here,
you go to a new assessment, and it will ask you
for like a organization name or a repo,
and it will go there and pull out information there.
Okay.
So, now it's trying to connect, it's not connecting.
Okay, so actually here by the name,
I start pulling some repos.
Of course, usually when this, when it has connection here,
it will show you the images.
Now it's trying to connect externally,
and I have the Wi-Fi turned off, I don't know why.
But, so now it's not showing the image.
But anyways, I pretty much know that.
So, first one is the repo for Raspberry,
ID Software, PLC, which are some popular repos.
I started getting, also Nmap, Metasploit,
just to give me an idea.
Yeah, all the people.
If we go, for example, for the first one,
let's go there.
Yeah, here the tool, as I say, is looking for credential,
credential, and buyback key, so that's,
so you guys have, your company did have repos.
It's a nice tool just to make sure you have not published
any credential or anything like that.
But I'm not using the tool right now in that sense.
What I'm looking for is the user epos.
That's something I'm interested.
I don't know if we're gonna show me the pictures.
Let's see.
Oh, it's not showing me the pictures
because it's a connection.
It's trying to connect there.
Okay.
I didn't check that, but, so.
But I came prepared just in case.
Okay, so I put a video because it's trying to connect
all the time and it's not showing me the pictures.
But just in case, I did a small video
because this is DefCon and you don't know.
So this is, when you have the repos,
it's showing you the pictures.
And this interesting thing is it starts showing me
the users and what pieces of code they have been working.
So that's nice.
Now I have information.
I start seeing relationships there.
Well, this is one of the repos I did software
with the Doom game.
Who doesn't love the game, the Doom, right?
From the old days.
And we'll take a look in a little bit as well at the Doom.
So here we have some repos and map, metasploit and stuff.
I don't think that's the original metasploit,
but anyways, it's nice to take a look.
So yeah, we can see the different pictures.
And pictures can tell us a lot of information there.
Okay, if we go to the Raspberry repo,
we can see all the files here.
But as some say, I'm not really interesting
in that at the moment.
Well, when I'm looking for popularities, of course I am.
But right now I'm more interesting in the users.
And what information I can get from those users.
And that tool is quite convenient.
For example, this is one of the developers, Damien.
I can click.
And now he's giving me some info there.
Move there.
Okay, so now I have a name.
I have a place he's working.
A location.
And a Twitter account.
So now I have a bunch of information I can keep going
and start targeting more and more of this user, right?
So that's quite convenient for me.
And of course, the nice of the tool is that
all information is put into PostgreSQL Server.
So everything, what you see here is stored in a SQL Server.
So you can also make your own queries and search for info.
So that's quite convenient.
Find this tool quite nice.
It's a simple tool, but very nice.
So now I have the Twitter account.
I can do more things.
We will do that in a little bit.
Okay, I can look at the pictures.
And give me an idea of the...
This should be a fun guy, I guess.
Okay, I have a mail address.
Yeah, of course, I can go to Google
and do some searches and stuff like that.
But right now, I want to avoid that for a reason.
Actually, there are more counterintelligence companies.
Creating fake information on social networks
and all that stuff, and they monitor those sites.
But right now, the repos are not that monitored.
So now I'm getting a lot of info
without going for social networks at the moment.
So trying to avoid those counterintelligence companies.
So that's one of the things I'm trying with this research.
So yeah, I have location there,
and I can start putting this info
and use other well-known tools,
as we use with this, right?
So it's quite convenient.
Okay, so that was the GitHub repo.
I found this tool quite nice.
It's not showing me the pictures, no.
Well, there were a few more pictures I wanted to show,
but I cannot do that.
So I didn't tell without connection.
I was all the time connected,
so I didn't realize I need connection for that.
But anyway, just go.
And it's very easy to set up.
So that was good,
because usually open-source tools are a pain in the ass.
But that one is quite easy to install and use.
So give it a try.
It's a nice tool.
Okay, so.
The only thing is in Ruby,
but that's the only thing I can complain of.
So now, okay, so that was Gitrop.
So a nice tool to start getting some information
of the users and their repos and connections.
There's, of course, there's a lot of crawlers.
And there are many more.
That's some of the crawlers I have seen.
And writing your own code is also easy.
It's not that hard, I mean.
So if you don't want to use Gitrop,
you can just, for example, go this.
The first two are Python-based,
and the other one, I think it's in JavaScript.
So there are many more.
I think there are some Ruby crawlers.
A lot of people have been releasing GitHub crawlers
we can use.
And we don't want to use the Gitrop tool seen before.
We can use those crawlers and pull the,
or we can also do a cron, git cron, that works too.
But that allows us to do a lot of repos at the same time.
So some of the tools we can start using,
especially if we want to automatize things.
Okay, so another thing I've been working on lately,
and that's quite a thing,
I mean, we're in DEF CON, so I guess everything is allowed.
But anyways, just to make sure,
if any, hopefully you guys don't get offenses.
It's not me, it's the source code.
So don't get offense or anything like that,
but you will be surprised what you can see in source code.
And the idea for this is to look for bad words
in the source code,
because this is some basic developer profiling.
I want to get a feeling how these guys feel.
And I want to be, is this guy angry or not?
And source code is, so I've been working in,
usually in Twitter it's quite common to do that,
the sentiment analysis, we'll talk about that a little bit.
And I apply the same techniques into source code.
That's a bit tricky, that we have to still,
it needs more work, for sure.
But yeah, so I will show you a few things, right?
So you look into the Linux,
and the source code.
This is for real, this is what you can find
in the Linux source code, so you can see,
I guess at some point, I can move with this,
I don't, I'm not sure, so you can see between
versions there, two, six, nine, and three,
something happened, I don't know what happened there,
I guess it was, I don't know what happened there,
but there was a lot of shit and crap
and everything, pretty much, so I guess they were working
on something new, I guess.
But you can see that there.
So there was a lot of ugliness there going on.
And the thing is just going up.
So I guess it's not something, but that's funny.
That gave me an idea what's going on with those people.
So yeah, but everything is not that bad.
I mean, it's not only bad words.
You can also find good words.
Okay, so that's fine, right?
So we have some love, we have some good, nice,
and sweet, and kids, right?
But looking at both things,
we can see more ugliness than happiness.
So we should be concerned about that, I don't know.
But yeah, so not everything is bad.
So that's good.
If you go to that URL, you will find more funny metrics,
like this one, just related to the Linux kernel.
So it's quite funny.
Okay.
So let's do the same for the reports we are working on.
One other thing,
one thing I've been, when I've been doing this,
is you guys seem to more data science
with all the process in data science with information.
There is the process we have to data cleaning, right?
You get information, but not all information you need is,
is what, you don't need all the information you collect.
You have to do some cleaning.
And it's so good, and it's so good,
it's gonna happen, big time.
Because, for example, in the case of the comments,
you get so much crap, you don't need that,
and it doesn't happen.
It doesn't have any value for us.
Like, for example, in comments, you can also find code.
We don't want that.
We don't get pretty much any, any result for that.
If we're going to do more, like, sentiment analysis
or anything like that, or, it's not gonna help.
Some code statements, nothing I can use.
We also have, there's a lot of bad characters,
like dollar sign, equal, and all that stuff.
We should remove that.
It's the same when we do Twitter analysis.
Usually remove the hashtag and all that stuff.
Okay.
It's the same thing.
So, and also when I was looking around,
there's just a lot of useless text.
Especially with license.
People put all their license in their source code,
and doesn't give me anything,
because that code is not from the developer,
so I don't need that.
And we can see a lot of that into source code.
So that's things, so right now,
something we have to improve a lot,
because I've been writing some tools and stuff,
but this isn't much work,
or to be done, because there's so much stuff
in the comments I don't need,
so right now, it's something we have to improve.
How to get comments that I can really use.
So, for example, in here,
for the comment, for example, we have here,
I don't know, let's see.
For example, we're gonna do, this is one of the tools I use.
Tools, projects.
Let's do, I don't know, which one.
Nmap I guess.
C.
And now, this, excuse me,
course, because I didn't do the slash B.
Nope, okay, now what the tool did, it created,
I did a, oh, something wrong there, ah, okay, my bad.
Okay, there.
So what I did is I used a small tool I wrote,
and that tool I have to improve a lot.
But now it's going to the repo, I download it,
and I'm telling, look for C files,
and pull out all the comments.
So yeah, so as you can see, there's so much stuff there.
It's not like Twitters, like if you go to tweet,
you can start downloading all the tweets,
and take those tweets, and analyze them.
Here we have to do a lot of cleaning.
And that's a thing I'm working,
but there's much more work to do,
because you can see we have so much stuff
that doesn't mean anything.
For example, we have a license here,
so we have to remove that.
So there's a lot of data cleaning we have to perform
to really get some information I can use,
or get a feeling of the developers.
So yeah, so that's a work in progress.
Just to give you an idea what things we have to do, right?
And you can see this, yeah, numbers here,
probably doesn't mean, doesn't have any value for me.
Yeah, so sometimes you can see comments
that are really interesting,
but I don't know if I can find any of those right now.
But yeah, just looking around, so that takes time.
So this, right now is a bit manual process.
We have to start, usually what I do is
I pull all these to a CVS,
and then I can open with different tools,
and start removing.
Some things, but it's quite time consuming at the moment,
right?
If anyone have a good idea to manage this, perfect.
Just let me know.
I'm working on different things to speed up this process,
but right now it's a bit time consuming.
Well, data cleaning is what we say.
Even in data science, and everyone familiar with that,
it's a hard process, right?
Not everything can be optimized.
It's hard sometimes.
Okay.
As you can see, we can get so much comments and stuff.
The only thing, we have to find information we want there.
There's chances that we can find something
that can be used, but we have to find it first.
But at least we start narrow things, right?
I use source code.
Now from the source code, I'm getting comments.
Now I can start.
I'm just narrowing the information I want.
Okay.
So you can see there's a lot of comments here and stuff.
So just being there and taking some time
to see what's going on.
Okay. So that.
We can find some interesting things in the comments.
But let's move on, and hopefully it will be more interesting.
So another tool, I developed this tool.
It's a source code intelligence tool.
I use this tool to compile projects.
What I do is an analyzer there.
It's a tool that runs inside GCC.
When you are building projects,
it will pull out intelligence from the source code.
So all it works in GCC and for C code.
But at the same time,
I'm starting putting, so now has become a framework.
So I'm adding more tools into the framework
called Profanity and Ausinter there.
So Profanity, we look for bad words in the code.
And Ausinter, we look for open source intelligence patterns
in the source code.
And those two are completely language agnostic.
It will go for the files.
Analyzer has to be running inside GCC for C code.
But Ausinter and Profanity is completely agnostic.
So those are the tools we're gonna start using
to get some information.
Okay, so for the functions,
so I'm not gonna run them because,
well, Profanity is not that,
Profanity is more or less fast
depending on the size of the code, of the code base.
But Ausinter takes quite a lot to run.
So I will skip that.
I've already run it.
I'll run them in several reports to get some results.
So for example, let's do the DOOM as a Profanity.
So what I did is I run a Profanity tool
and create a JSON file with all the bad words.
And now I use another tool inside the framework
to generate a report.
And this is the DOOM source code from the game, right?
And we can start seeing some words there, right?
So don't get offence if you see something there.
So yeah, we can see there is hello.sac,
fuck, shit, ass, bastard,
sex, asshole, I don't know.
You go there to the, and sometimes,
sometimes you go there and check this.
The file, maybe you can find a comment there
that somebody, sometimes they talk about somebody else
in the company.
. Or,
Or this code sucks, and actually sometimes
this code sucks because it's hard,
or they have a bug or whatever,
so that's also convenient for us.
No, right now I'm using two dictionaries,
English, and I was just looking for English and Spanish,
but in the Tintorella, there's dictionaries
for, I think, 15 languages, from Chinese,
I don't know, there's a lot.
The only thing is, for speed,
because I was only interested in English and Spanish,
I removed all of them, but you download the tool,
you have all the dictionaries.
The only thing is, it takes a bit longer to run,
because you're looking at all the words.
Yeah, but it's pretty much, yeah, I mean,
this is a, it was a U.S. company, it's in Texas.
So yeah, they were pretty much,
so I guess all the bad words are in English,
that makes sense.
Yeah, so there is a bunch of there,
and the funny thing is, I guess when things
are moving forward,
the things are getting nastier,
because this is the code for the Doom,
for the Doom, and as you can see,
they are not that much.
So okay, that's okay, actually,
in terms of bad words.
If you go to, for example, Quake 3,
from the same people, and that's,
so you can see, actually, there are, yeah,
there's a lot of X there,
but there are more, yeah, so there's a bunch of words,
so there are more, actually.
So this is a newer game, but the newer game
is seven years old, but they use more bad words
in the game than before, right?
So I guess there are more stress, I don't know.
Hardcore, I don't know.
When you start looking at those files,
it's very funny to see where that word is,
and what they're saying, what are they saying there.
So that started giving me a feeling about these guys.
Yeah, that was funny.
Actually, you go to there, to the caster fact,
that one, I look it up, because I say,
what's going on here?
Actually, it's a function there,
and they say, this function is a caster fact.
It has to be fixed.
So when I'm looking for vulnerabilities,
that's a place I will go, that's for sure.
Okay, so that was a profanity to do, right?
So, okay, that's,
so that's,
that's why now is to start looking and get a feeling, right?
So now we can do,
actually, there was another thing I did before.
Let me, actually,
so,
so what I did is I started taking some of the developers
of these reports,
so I was looking at these reports,
I didn't show you,
for example, TensorFlow,
you guys familiar with Google Framework?
And actually, there's pretty much no bad words in TensorFlow,
and the code base is huge,
so I don't know if the people in Google are nice,
or they are,
they don't have some kind of bad word policy.
I don't know, but I was surprised about that.
It's a huge code base,
and pretty much there's no bad words.
So I don't know if there's some policy or not.
But, for example, looking at those,
what I did here is I downloaded,
those are the tweets from several developers,
and I did, I downloaded the tweets,
and I submitted to Sentiment Analysis API
to give me a feeling of this guy's, of the angriness.
Can you guys guess who is the most angry person here?
No.
No guess there?
Excuse me, who?
Who?
Carmack.
Actually, that's right.
That's the own Carmack,
that's the developer of Doom and Quake.
You go downstairs,
so those are all the tweets,
and that's very easy to do with Python script,
and take the tweets and submit it to an API for analysis,
and it's free, actually, so that's, I always do that.
So here you go to, so now I have some statistics,
so let me move that there.
So yeah, we can see, actually,
this guy is more negative than positive.
So that's quite interesting,
to give me an idea of when I'm profiling this developer.
No wonder there's so much bad words in the games,
in the source code.
So that's quite interesting to do, right?
We have also the VLC, because you know, guys,
VLC, there's also some different type of vulnerabilities there,
so I want to, when I'm looking for vulnerabilities in software,
so it's nice to get a feeling of how these guys are feeling.
Yeah, okay, more or less neutral, okay.
So yeah, you can do those type of things,
just to give me an idea of the developer.
So I think it's quite nice.
And then we have also the open source patterns.
At the end, there's one of the tools,
in the Tintorella framework,
that pretty much do this,
but you can also do it by your own.
So at the end, we will look for IP links,
emails, and different stuff in the source code.
I don't want to go to the Google or anything
to start doing searches at the moment.
I'm looking on the source code.
And you will find a lot of information there,
quite interesting, doing the same thing.
So for example, here, there is a TensorFlow,
the repo in TensorFlow.
There's a regular expression there.
I'm looking for email address.
So now I have a bunch of address.
Of course, I have to do some cleaning there.
That's easy to do.
And now I can take all those email address,
and use all the different other tools,
other tools, open source intelligence,
and put those emails,
and start getting information about it.
So it's quite nice.
And the good thing is, many times,
people in source code, they forget stuff,
they put more links, internal IPs.
So that's quite convenient.
So now I have, so now I have, so now I have,
information about more sensitive information.
The chances of doing Google searches,
I might or might not find them.
Okay, well, that's, some of the queries,
I mean, that's, I don't know.
That's not too excited there.
But that's, for example, I can post those online.
But those are some of the queries I use.
And you can also find them in the tutorial tool.
That one is for look for email address,
IPs, and stuff like that.
So don't worry.
I can post those.
Those are my simple,
right expressions to search for information, right?
Okay, and now, for example, so now I can have links,
IPs, domain names, names of the developers.
So a bunch of information now.
Okay, after some doing some cleaning,
I can start using my regular open source tool
that we all, the open source intelligence tools
we all like, right?
I can start putting those information into Maltego,
Recone NG, Data Spread, and of course,
some custom, you know, some custom, you know,
the scripting tools, right?
I have a bunch of custom tools that I've used.
All this information I get from the source code,
pass it to those scripts.
And now we can just go a regular approach
in the open source intelligence, or send.
So yeah, so from a point of view,
I think a source code is Google,
because many times, people don't pay too much attention.
They just submit to the reports.
So if, so in source code, it's Google,
and in source code, we can find open source intelligence.
We can find email, links, IPs, and stuff like that.
We can sometimes find sensitive information.
People forget tokens, credentials, and stuff like that.
So we can actually, so that's nice.
We can also do comments and sentiment analysis.
We have to do a lot of cleaning on the comments,
but we can still do some,
so get a feeling of the developers,
and of course we can also find more of these.
So yeah, so in my opinion, source code is really nice.
It's a gold mine.
The only thing is,
we have to harvest that.
And of course, from talking with people,
yeah, there's a lot of, I was mentioning before,
there's a lot of, there are several companies
doing content intelligence and stuff like that.
They put fake data in social networks and other stuff
to make open source intelligence harder.
But core reports at this time, from my understanding,
people don't pay so much attention.
So we can go to the reports and start getting info
without going to the social network,
without making any attention to go to the social network,
for example.
And pretty much we can get a lot of information as well.
So yeah, so source code is gold.
So next steps, there's a lot of work to be done.
So yeah, we have to, for sure we have to do some,
actually, when we're talking, I don't know,
let's see, I don't know.
I was talking with Data Spirit,
and actually they were saying that they want to also
add some stuff like this into Data Spirit.
I think that's quite nice, right?
So yeah, so we have to improve this field, I guess.
So we need more improvement tools, that's for sure,
and more optimization, that's for sure.
For the comments, there's a lot of,
with the clean up analysis and classification
of the comments, so that's quite nice.
And I didn't go too much into the developer profiling,
but I'm still working on that.
And the idea is you take source code
and look in different type of parameters,
and then you go to the source code, and look in different type of parameters,
I can give you an idea of profiling the developer,
looking for how he writes, what's his style of coding,
and we can find similar coding of the developer in other places.
So that's developer profiling, and that's an interesting field.
But it's not, it's more or less related,
but it's another thing.
So yeah, so these are the things
we still have to improve in this thing.
And of course, we should start adding
or Data Spirit or Rekon NG or other tools,
start adding these source code analysis
and get information into those tools.
So yeah, that's, so I think that's pretty much the talk.
I don't know how I am in time.
I'm good or not?
Or what time is it?
I don't know.
I'm okay.
So you guys have any questions, comments?
Yes, please.
I noticed that you posted the source code
as a zip file.
Yes.
And you can't run your code against your code.
Yeah, that's the point.
Yeah, that's the point.
That's called, that's open source ops.
No, that's, yeah, yeah, yeah, I know, I know.
I have to fix that, yeah.
Yeah.
You guys have any more questions?
If you guys want to talk about open source intelligence
or something like that, probably I will be in the bar
in the afternoon, so come and grab me for a beer
and we can talk some.
You guys have any more questions?
No?
Thanks a lot.
It's been a pleasure being here.
And no, thanks.
Thank you.
Thank you.