WEBVTT 00:00.580 --> 00:06.600 Hello DEF CON and welcome to my talk here at the Recon Village for DEF CON 28 Safe Mode. 00:06.700 --> 00:08.360 Super excited to be here. 00:08.360 --> 00:13.020 This is my first time ever as part of the DEF CON speaker community. 00:13.020 --> 00:14.460 I'm super excited. 00:14.460 --> 00:20.100 So I hope you're excited also while we start talking about Ambly, the smart darknet spider. 00:21.980 --> 00:25.880 So who am I that's talking to you about this really cool project? 00:25.880 --> 00:29.200 I am known by a few names online. 00:29.360 --> 00:34.280 This may or may not be all of them, but it certainly is the few that are most common. 00:34.780 --> 00:37.400 Some people will know me as Cytissus Eurydice. 00:37.400 --> 00:39.400 Others may be CyberSci. 00:39.580 --> 00:44.200 Most people in this community are going to know me as Levitanin or Levi. 00:44.240 --> 00:48.480 This is what I am online where I'm actually interacting with people most often. 00:49.180 --> 00:56.860 By day I am a cybersecurity incident response professional and by night I'm a darknet researcher by choice and trade. 00:56.920 --> 01:03.940 I am a self-proclaimed master of spiders also, which may or may not be both on the computer and off of the computer. 01:04.740 --> 01:10.060 Just keep in mind that spiders in real life out in the wild, they're doing a lot of good stuff for us. 01:10.160 --> 01:17.180 But those online, they're equally hiding in plain sight doing a lot of cool things that we need them to do every day. 01:17.340 --> 01:29.360 And I'm here hoping to create tools that are based off of these spiders and build upon them in order to help us in fields like open source intelligence, threat gathering, and other research areas. 01:29.680 --> 01:36.820 But before we get ahead of ourselves, let's talk a little bit about TOR because we're going to be talking TOR a lot today. 01:37.020 --> 01:43.940 Keep in mind though that TOR is not the only darknet access point, so we're going to be mentioning a few others as well. 01:44.100 --> 01:53.740 Before we get too too far ahead of ourselves, because I could talk TOR, darknet, and spiders all day long, let's talk a little bit about the different layers of this presentation. 01:53.920 --> 01:57.680 We're going to be going over open source intelligence, or OSINT. 01:57.680 --> 02:03.380 We're going to talk about cyber threat intelligence, which you'll often see abbreviated as CTI. 02:03.880 --> 02:07.980 We'll talk about the different layers of the internet, which I've already slightly touched on. 02:08.060 --> 02:13.600 We'll also talk about the difficulties of finding cyber threat intelligence on the darknet specifically. 02:13.780 --> 02:21.960 And finally, this is going to lead us into talking about Ambly, a smart darknet spider specifically designed for cyber threat intelligence. 02:22.160 --> 02:24.040 So let's get started. 02:24.340 --> 02:26.640 What's open source intelligence? 02:26.640 --> 02:35.900 Most people in this village specifically probably have some sort of idea about what open source intelligence is, but we're going to break it down a little bit anyway. 02:36.320 --> 02:44.840 Open source intelligence is anything that is accessible from original sources, broken down as accessible original information or data. 02:45.240 --> 02:55.640 You can also explain this further by saying something that is posted, viewed, or interacted with by a user, which is accessible publicly online or offline. 02:55.640 --> 02:58.760 It doesn't have to be specifically on the internet. 02:59.180 --> 03:05.920 This includes, but it's not limited to, the internet at the clear, deep, and dark levels, which we'll get into later. 03:06.040 --> 03:17.840 Mass media, television, radio, books, journals, print of all kinds, video games, specialized journals, conference materials, and think tank studies. 03:17.840 --> 03:18.920 These are out there. 03:18.920 --> 03:20.560 People are talking about them all the time. 03:20.560 --> 03:23.620 We're going to be posting about DEF CON for months after this, right? 03:24.060 --> 03:30.160 Then there's photos and videos, not just on YouTube or Snapchat, but in general that are posted publicly online. 03:30.560 --> 03:42.080 Finally, another area is geospatial information, such as where they actually are located, their GPS, where on a map they may be, or even their IP addresses. 03:43.860 --> 03:46.980 So, what is OSINT good for? 03:47.180 --> 03:49.100 Absolutely everything. 03:49.100 --> 03:56.620 And if you thought about that with a tune in your head, you thought right, because I was talking about that song that's now stuck in your head. 03:56.620 --> 03:58.300 You're welcome for the earworm. 03:58.880 --> 04:16.160 So, OSINT can be utilized in an array of situations, including, but again, never limited to, designing internal training for a company, understanding your threat profile, beating Keith and Joe at an open source CTF that may or may not be hosted by, you know, 04:16.160 --> 04:19.000 Trace Labs today, later on after this presentation. 04:19.000 --> 04:19.820 Maybe, maybe not. 04:19.820 --> 04:20.680 I don't know. 04:21.180 --> 04:30.340 Volunteering, finding out the title of your favorite book from when you were nine, but you forgot existed for about 10 years and you desperately wanted to read again sometime later. 04:30.640 --> 04:38.900 Yeah, all of these are actual areas that I have used OSINT for on the clear net and down into the dark net. 04:39.540 --> 04:45.540 And that book, for anyone who was interested, was called Goddess of Yesterday, which I highly recommend. 04:45.760 --> 04:47.060 It's a good book. 04:48.800 --> 04:56.080 But, now you may be asking, if you're not used to this field just yet, is open source intelligent gathering legal? 04:57.160 --> 04:58.660 Short answer is yes. 04:58.980 --> 05:03.960 Long answer is depends, which is a longer word than yes. 05:04.160 --> 05:10.720 The longest answer is, if you're in a country outside the United States, I don't know. 05:10.720 --> 05:11.520 It's going to depend. 05:11.520 --> 05:13.920 You're going to have to look into your own local laws. 05:13.920 --> 05:18.860 Even in the United States, you're going to have to look into your laws per capita, per state. 05:19.420 --> 05:21.740 This may be different in some areas. 05:21.740 --> 05:30.800 In Europe, I'm expecting that there's probably a lot stricter regulations on what is or is not open source intelligence than there may be here in the United States. 05:31.040 --> 05:48.660 That being said, in the U.S., there's a public law that open source intelligence is produced from publicly available information, collected, analyzed, and disseminated in a timely manner to an appropriate audience, and addresses a specific intelligence requirement. 05:48.660 --> 05:53.560 This is what's publicly posted on the CIA's website regarding open source intelligence. 05:53.560 --> 06:04.000 Now, there are a few other sources that you can look into, including the public law number 108-458, posted in December 2004. 06:04.080 --> 06:10.340 We also have the FOIA B3 exceptions from the 50 U.S.C. 06:10.800 --> 06:15.500 403-1, which is on intelligence sources and methods. 06:15.540 --> 06:23.700 And finally, ATP 2-22.9, which is the Establishment of Open Source Intelligence for the Army. 06:23.700 --> 06:32.180 These are all laws that are out there that you can read up on, and they will help you understand what is and is not legal in the United States. 06:32.340 --> 06:34.680 Again, certain states may vary. 06:36.060 --> 06:39.360 All right, we're going on to the next section now. 06:39.360 --> 06:41.860 We're going to start diving into cyber threat intelligence. 06:41.860 --> 06:49.720 But first, let's take a step back, let's relax a second, and let's think through a scenario that's going to come up again and again to this presentation. 06:50.380 --> 06:52.860 One, let's go. 06:53.000 --> 06:55.900 During a pandemic, you're working from home. 06:56.140 --> 06:58.040 Everyone's working from home, we hope. 06:58.040 --> 06:59.380 Stay safe, right? 06:59.600 --> 07:06.120 Your company, which is global, just announced it's working on processing pandemic data to help drive towards a cure. 07:06.420 --> 07:08.060 Great, that's awesome work. 07:08.060 --> 07:14.080 But does that open you up to some threat that may be out there, some cyber threat actors? 07:14.800 --> 07:28.740 As part of the cybersecurity team, your job and your goal is to identify if there are any actors out there that you need to be aware of, and anyone who may be actively targeting not only your company, but companies in your industry. 07:29.240 --> 07:30.100 So what do you do? 07:30.100 --> 07:31.500 How do you find that out? 07:31.940 --> 07:34.240 Keep this in mind, we're going to come back to this. 07:35.860 --> 07:38.740 All right, what's cyber threat intelligence? 07:38.740 --> 07:42.160 I just kind of threw a scenario at you, but what are we even talking about? 07:42.300 --> 07:51.160 Well, cyber threat intelligence is the collection and analysis of threat actors' motives, targets, and attack behaviors in the realm of cybersecurity. 07:51.820 --> 07:57.340 Often automatic machine learning and techniques implemented for data collection and processing. 07:57.480 --> 08:00.340 This is how we are gathering this information. 08:00.340 --> 08:02.460 However, you can do it manually. 08:02.460 --> 08:14.960 This is helping to shed some light on preemptive actions, or for preemptive actions, and reveals adversarial motives and tactics, techniques, and procedures, or TTPs, which we'll be talking about a lot. 08:15.900 --> 08:23.220 The reason we do this is to help in three areas within a company or possibly even the government. 08:23.280 --> 08:34.520 And what these areas are tactical, which is where you're performing a malware analysis and enrichment, you're collecting threat indicators, and you're trying to help out with defensive cyber teams. 08:34.720 --> 08:40.620 The goal here is to be able to talk to a semi or more technical audience. 08:40.760 --> 08:42.880 Then you have the operational team. 08:42.880 --> 08:49.200 You have a team that's trying to understand adversarial capabilities, infrastructure, TTPs. 08:49.200 --> 08:55.140 You want to leverage this information to conduct targeted prioritization operations. 08:55.240 --> 09:06.080 This team is probably more technical with the details and they want to know about attacks and campaigns from the past, the present, and possibly, if you can anticipate it, the future. 09:06.840 --> 09:09.780 Finally, we're talking to the strategic team. 09:09.840 --> 09:13.960 This is the team that needs to know all of this information at high level. 09:13.960 --> 09:16.340 They want to know about adversarial motives. 09:16.340 --> 09:18.640 They want to know who's targeting your industry. 09:18.720 --> 09:23.220 They want to be able to leverage this information to engage in strategic security. 09:23.580 --> 09:33.440 This is for a non-technical audience in most cases, but it's really important that we make sure that they understand what's going on and why it's important to focus in on this information. 09:34.540 --> 09:37.020 Now, are there companies out there that are focused on this? 09:37.080 --> 09:37.960 Absolutely. 09:37.960 --> 09:44.180 A few of the top ones are Recorded Future, CrowdStrike, FireEye, Mandiant, and SANS. 09:44.420 --> 09:50.860 And this is an area that more and more people are getting involved in, especially right now and in this scenario. 09:50.860 --> 09:56.200 When there's a pandemic or there's a work-from-home situation, you have to be aware of your cybersecurity. 09:56.680 --> 10:01.960 So , the more people who are looking at this, the more we need to know about it and know how we can dig into it. 10:03.520 --> 10:11.140 So, what are some tools that we can use right now if we wanted to get into open-source intelligence and cyber threat intelligence? 10:11.480 --> 10:20.540 Well, we've got Maltego, Spiderfoot, MalShare, the Open Source Framework, which everyone should start at at some point. 10:20.540 --> 10:25.600 It's right there and it will lead you through the tree path to whatever you may need. 10:25.860 --> 10:33.080 We have the Check Usernames or Been Verified, which is a great tool to see if a username is used across platforms. 10:33.080 --> 10:40.940 You can use it to track people's movements if you need to find a target or if you're working on something like a CTF or Trace Labs. 10:41.400 --> 10:51.300 Or you can even use it for yourself to see if the username you want that you want to kind of trademark as your official account or handle is used anywhere that you may need to grab. 10:52.200 --> 10:53.160 Have I Been Pwned? 10:53.160 --> 10:54.640 Excellent resource. 10:54.720 --> 10:59.340 See if you or anyone else has been pwned , if their email addresses have shown up in any leaks. 10:59.560 --> 11:05.660 We've got Census, Shodan, which is one of my favorite sites, built with Google Dorks. 11:05.660 --> 11:11.100 If you know how to Google Dork, you probably are a leg ahead of a lot of people. 11:11.640 --> 11:19.840 Google Dorking, or which is Google Hacking, or just knowing the syntax of how to do a proper search with Google, is an amazing, amazing ability. 11:19.980 --> 11:21.860 And it's magic. 11:21.860 --> 11:23.700 I don't really know any way else to say it. 11:23.700 --> 11:24.660 It's magic. 11:24.920 --> 11:32.840 We have Recon NG, The Harvester, Nmap, Creepy, which is a little creepy, but you know, it knows it's branded well. 11:32.840 --> 11:34.560 There's so many tools out there. 11:34.780 --> 11:36.980 TraceLab has a VM full of them. 11:37.120 --> 11:43.340 OSINT Combine is another course where you can learn stuff about OSINT, and they have a lot of tools they talk about. 11:43.420 --> 11:48.960 Tools are popping up over and over and over again, all over the place, and most of them are open source. 11:49.020 --> 11:57.620 Some of them may have paid features that you can or cannot get if you want, but you can do a lot of this stuff without paying a dime, and they're very useful. 11:57.620 --> 12:01.100 So I highly recommend digging into these tools. 12:01.480 --> 12:04.500 And if we want to talk about these at all, please let me know. 12:04.500 --> 12:07.240 I'd be happy to chat with anyone about any of these. 12:07.540 --> 12:10.200 But for right now, we're going to move on. 12:10.860 --> 12:12.840 We're getting to one of my favorite parts. 12:12.840 --> 12:19.160 I could talk about this way too long, so I'm going to limit myself to three slides. 12:19.360 --> 12:20.280 Four slides, I lied. 12:20.280 --> 12:21.120 Four slides. 12:21.240 --> 12:23.280 We're going to talk about the layers of the internet. 12:23.640 --> 12:25.440 Number one, out of the box. 12:25.440 --> 12:30.080 Please, please, do not believe everything you see in infographs. 12:30.080 --> 12:37.440 Because honestly, I don't know how many times I see this whole igloo... is that the word? 12:37.440 --> 12:38.040 Ice cube? 12:38.120 --> 12:46.060 Iceberg that we want, that we see for the internet, for these three layers, or in some cases up to 12 layers I've seen. 12:46.500 --> 12:54.960 But I don't necessarily agree with this one based on my interaction with the layers of the internet, my understanding of it. 12:55.160 --> 13:04.580 But even more so than that, just like you can kind of do with stats, you can do almost anything with an infograph and be convincing. 13:04.580 --> 13:06.820 You can really get people's attention. 13:07.340 --> 13:09.120 So just keep that in mind. 13:09.140 --> 13:15.980 I'll get off my horse about that for right now and just let you know that we're going to be talking about the clear net, the deep web, and the dark net. 13:18.060 --> 13:19.020 Clear net. 13:19.660 --> 13:22.760 Everybody's favorite layer of the internet, even if you don't know it. 13:23.480 --> 13:26.480 The clear net is... oh, that might not be true. 13:26.480 --> 13:27.280 We'll see. 13:27.480 --> 13:32.340 The clear net is where you can access things like Google and Bing and DuckDuckGo. 13:32.340 --> 13:38.020 And if you look for something on Google and you can find the page, you're on the clear net. 13:39.540 --> 13:56.740 Otherwise, if you can find the front page but you can't find specific data, let's say you joined a forum and you're trying to figure out what's going on with one of the users, you might be able to search that user and see that that forum has a post, but probably not going to be able to see that post. 13:56.940 --> 13:59.960 Not without getting through an access point. 14:00.020 --> 14:02.540 And that brings you into the deep web. 14:03.020 --> 14:06.540 The deep web is anywhere where you're talking to people online. 14:06.540 --> 14:09.440 You're on Discord, you're at DEF CON, you're probably on Discord. 14:09.540 --> 14:13.100 By the way, DEF CON, you've gone to the DEF CON forums? 14:13.280 --> 14:14.340 Deep web. 14:14.340 --> 14:15.820 Like to play video games? 14:15.820 --> 14:17.360 Twitch or Steam? 14:17.360 --> 14:18.320 Deep web. 14:18.320 --> 14:21.640 How about ever log into a university or school portal? 14:21.640 --> 14:22.540 Ever. 14:22.540 --> 14:23.680 Deep web. 14:24.360 --> 14:27.100 You have a bank account anywhere? 14:27.240 --> 14:28.540 Deep web. 14:28.540 --> 14:38.800 All of these areas also have a front-facing website that is accessible via the Google, Bing, DuckDuckGo, whatever your preferred search engine. 14:39.240 --> 14:49.360 But because you have to have an access point, you have to go into this, you're running into this area where it actually is the deep web. 14:49.360 --> 14:57.880 It's not as accessible, it's not as indexable for those spiders and crawlers behind Google and other search engines. 14:58.100 --> 15:00.080 Which is what makes it the deep web. 15:00.080 --> 15:07.260 Which if you go back to that infograph, this should be the largest section of the iceberg. 15:08.220 --> 15:10.500 Which leaves us with the darknet. 15:10.500 --> 15:12.480 My favorite, personally. 15:12.780 --> 15:18.820 There's a few different ways of getting onto the darknet, but the top three access points are those we see here. 15:18.960 --> 15:27.200 We've got the Tor Project, which is the Onion Router Network, or just Tor, like we said, we're going to talk Tor today. 15:27.200 --> 15:31.100 And the focus is going to be on Tor from here on out for right now. 15:31.440 --> 15:33.780 But keep in mind that we also have the Freenet. 15:33.780 --> 15:36.860 We have I2P and the Bulletin Board System. 15:36.860 --> 15:44.560 All of these require specialized access and or knowledge in order to get onto and interact with users. 15:44.820 --> 15:49.800 For Tor, you need to get the Tor Browser to access the Onion Routing System. 15:49.840 --> 15:52.880 For Freenet, you need another specialized software. 15:53.520 --> 16:02.180 You can also get specialized software for I2P, which will run your traffic through different tunnels via peer systems. 16:02.180 --> 16:05.460 And BBSs require telnet client software. 16:05.460 --> 16:14.820 All of these require extra software and extra knowledge to even find these websites in most cases, or chat rooms, or what have you. 16:14.900 --> 16:17.740 And that's what makes this the Darknet. 16:17.740 --> 16:24.560 It's not easy to explore, to travel. 16:24.880 --> 16:29.960 If you're trying to get from one site to the other, you need to know someone or something to get there. 16:30.800 --> 16:33.160 So, what does that mean for us? 16:33.160 --> 16:35.900 What is cyber threat intelligence on the Darknet? 16:36.220 --> 16:38.460 Like I mentioned, we're going to focus on Tor. 16:38.460 --> 16:40.980 But first, let's go back and look at this. 16:41.020 --> 16:44.560 How long does it take to find a website for us to use? 16:44.920 --> 16:53.120 If you're on the ClearNet, a website that's newly posted takes about four weeks if you get the SOEs okay. 16:53.120 --> 16:57.540 If you get the SOEs set up really well for that website, it can take about four days. 16:57.540 --> 17:04.080 And then you'll start seeing it populated on Google or other search engines, depending on how it's set up. 17:04.280 --> 17:15.900 So, if I actually go and I log in and I try to find a website on Google, and it's not a hurricane, like it may or may not be outside, then what are we dealing with? 17:15.900 --> 17:17.800 A few seconds, maybe a minute. 17:17.800 --> 17:20.600 It's kind of based on your internet speed at that point, right? 17:20.680 --> 17:22.960 All right, what about the DeepWeb? 17:22.960 --> 17:28.060 Well, let's say the DeepWeb website has a ClearNet facing access point, right? 17:28.700 --> 17:33.140 Maybe you're trying to find a certain forum post. 17:33.140 --> 17:35.460 So, the forum you can find on Google. 17:35.460 --> 17:37.980 So, there's the few seconds to a minute. 17:38.280 --> 17:41.560 Then you have to either make an account or log in. 17:41.560 --> 17:42.720 So, that's the next time. 17:42.720 --> 17:44.240 Let's say that takes two minutes. 17:44.240 --> 17:45.740 So, that's three minutes now. 17:46.000 --> 17:46.940 Then you have to log in. 17:46.940 --> 17:49.980 So, once you're logged in, you then have to find the post you want. 17:49.980 --> 17:55.760 Now, a lot of these sites have internal indexing, which means you can search stuff internally. 17:56.080 --> 17:58.000 And that may take another minute or so. 17:58.000 --> 18:00.420 So, that's four minutes, five minutes. 18:00.680 --> 18:03.440 That's not terrible, so long as you know what you're looking for. 18:03.440 --> 18:06.220 If you don't know what you're looking for, it may take longer. 18:06.520 --> 18:14.880 If you're specifically trying to find information on a user or a subject, you may have to do a lot of digging before you come across what you really want. 18:15.000 --> 18:19.700 And in those cases, it could be extended for a very long amount of time. 18:20.140 --> 18:21.140 That's fine. 18:21.300 --> 18:22.720 What about the DarkNet? 18:22.900 --> 18:24.860 How are you going to find a DarkNet website? 18:25.540 --> 18:27.280 Some of them are posted on Reddit. 18:27.740 --> 18:32.580 If you look up DarkNet websites, you're usually going to get Tor, and they're usually on Google. 18:34.140 --> 18:38.380 Pastebin, GitHub, some of them are on GitHub, yeah. 18:38.980 --> 18:42.620 Well, even if you find it, what do you do with that? 18:43.200 --> 18:45.300 It can take some time to find websites. 18:45.300 --> 18:46.460 Are they really what you want? 18:46.460 --> 18:47.600 What are you looking for? 18:48.140 --> 18:51.640 And what about how do you access them? 18:51.840 --> 18:55.280 And how long does it take to access them as compared to the ClearNet? 18:55.780 --> 19:01.880 Well, let's take a look at our scenario from earlier, and we can try to figure this out. 19:02.800 --> 19:05.220 So, some extra details. 19:05.480 --> 19:11.200 You've uncovered information about a group targeting your company, or in companies like yours. 19:11.200 --> 19:16.280 The information you have indicates that this group is active on Tor, but not where they're active. 19:16.660 --> 19:19.340 How do we go about finding this group's activity? 19:19.740 --> 19:21.260 Let's walk through it. 19:21.460 --> 19:23.040 Manual investigation. 19:23.040 --> 19:24.320 Step one. 19:24.320 --> 19:28.420 Let's figure out what's going on by using Google as an ally. 19:28.420 --> 19:31.040 And I'm going to start with Google, because most of us do. 19:31.640 --> 19:36.300 Personally, it's not my preferred search engine, but it is one of the better ones. 19:36.600 --> 19:37.240 Oops. 19:38.580 --> 19:42.680 So, what do we have? 19:42.680 --> 19:45.360 I just searched here for Tor websites. 19:45.760 --> 19:47.040 I got a few of them. 19:47.040 --> 19:48.420 Here's a quick snippet of them. 19:48.420 --> 19:51.020 We've got nine best onion sites to visit. 19:51.020 --> 19:51.800 Awesome. 19:52.080 --> 19:54.580 List of some sites from Wikipedia. 19:54.580 --> 19:55.140 Cool. 19:55.140 --> 19:56.340 Very nice. 19:56.540 --> 20:00.400 We have best onion sites and how to access them safely. 20:00.460 --> 20:01.480 Awesome. 20:02.060 --> 20:10.740 How to find active .onions darknet sites and why... And finally, we have the best darknet websites you won't find on Google. 20:11.760 --> 20:12.740 Hmm. 20:13.280 --> 20:20.380 I don't know about you, but that one seems a little weird, considering we found the link on Google. 20:20.860 --> 20:22.380 Personally, I think it's funny. 20:22.380 --> 20:24.040 So, I'm going to pick that one. 20:24.200 --> 20:26.240 So, that leads us to step two. 20:26.740 --> 20:34.920 Pick a rabbit hole to dive down, which is what we're going to do with the best darknet websites you won't find on Google, as found on Google. 20:35.620 --> 20:41.100 From there, we're going to go into what does this article or this area have. 20:41.460 --> 20:45.020 So, the first one they listed was the hidden wiki. 20:46.140 --> 20:47.180 Surprise, surprise. 20:47.180 --> 20:49.500 There are a lot of hidden wikis. 20:49.500 --> 20:50.600 Some of them are mirrors. 20:50.600 --> 20:51.720 Some of them are just lists. 20:51.720 --> 20:54.260 Some of them are kept up to date, and some aren't. 20:54.260 --> 20:59.460 This one is the general normal access point, but there are others, and there are some that are better. 21:00.280 --> 21:05.000 They also have here hidden answers, which is another good one, and generally anonymous. 21:06.520 --> 21:08.880 But one big thing I want to note here. 21:09.620 --> 21:16.800 If you look at these two, and I've got my mouse over here just to show you these two URLs. 21:16.820 --> 21:20.920 First off, we're on tour, so all the URLs are going to end with dot onion. 21:21.460 --> 21:25.560 But you'll also see that this one is very short. 21:25.560 --> 21:26.820 It's a bunch of gobbledygook. 21:26.820 --> 21:32.140 You're not going to be able to understand what it is in most cases, but it's short. 21:32.140 --> 21:35.800 And that's fine and dandy, but that's a v2 URL. 21:36.220 --> 21:45.100 What's going on right now is that we're switching over to v3 URLs, which are these longer strings, usually around, I think, 52 characters. 21:45.480 --> 21:53.380 Sometimes you'll be able to see a tag like this, where it's got an actual human readable English readable word in the beginning. 21:53.720 --> 21:58.220 But generally speaking, we're just looking for these longer URLs. 21:58.220 --> 22:01.240 Those are the ones that are going to be sticking around for a while. 22:01.600 --> 22:05.300 This shorter one is going away in 2021. 22:05.400 --> 22:09.340 So yay, we found this, but what does that mean? 22:09.980 --> 22:11.600 What are we going to do about that? 22:11.600 --> 22:15.340 And how does that, how do we get an updated one if this is a good starting point? 22:15.340 --> 22:17.060 We're going to talk about that too. 22:18.360 --> 22:20.500 So, step four. 22:20.580 --> 22:23.500 We found the URLs, but how do we actually access them? 22:23.580 --> 22:32.420 If you go and plug and play those dot onion links into your Google Chrome or Firefox or any normal standard browser, you're not going to be able to reach it. 22:32.720 --> 22:36.860 You need to be part of the Tor network or the onion routing system. 22:37.360 --> 22:44.300 In order to do that, you need either to set up the proxy or you download the Tor browser. 22:44.420 --> 22:45.600 So this is Tor. 22:45.700 --> 22:48.620 This is the base browser that you have right now. 22:48.620 --> 22:51.440 It's updated to 9.5.3. 22:51.540 --> 22:57.800 It's based off of Mozilla Firefox and it allows the user to connect to the Tor network and onion router system. 22:57.960 --> 23:00.640 Now, you can change a few settings in here. 23:00.640 --> 23:05.680 Generally speaking, it's not recommended to have JavaScript on. 23:05.680 --> 23:11.700 For example, you want to try to be in the safest mode you can be when going through different sites. 23:12.180 --> 23:15.640 And you start off with the search engine DuckDuckGo. 23:15.640 --> 23:18.220 Now, DuckDuckGo is a clear net search engine. 23:18.440 --> 23:24.740 It doesn't necessarily help you with Tor websites, though it can give you some results similar to if you look up on Google. 23:25.560 --> 23:32.740 But now we can quickly and easily pivot into using those URLs that we found earlier. 23:32.740 --> 23:34.380 So let's go to the hidden wiki. 23:34.900 --> 23:39.100 Here's the first thing that popped up when I went on the hidden wiki about two days ago. 23:39.300 --> 23:44.620 Top of the page, hidden wiki, new URL as of 2019-2020. 23:44.880 --> 23:47.480 Add this to the bookmark and spread it. 23:47.480 --> 23:50.100 This is the current URL for the wiki. 23:50.360 --> 23:52.120 Now, can you get there from the small one? 23:52.120 --> 23:54.520 Yes, which you can see right here at the top. 23:54.520 --> 23:58.280 I was accessing the small v2 URL. 23:58.580 --> 24:04.760 This is the v3 URL and it's going to help us stay connected to the wiki as long as it's viable and up. 24:04.780 --> 24:15.760 So when you do come across these v3 URLs, you want to grab them or you may lose access to the site and beyond normal losing of access on darknet. 24:16.740 --> 24:18.920 So we're on the wiki. 24:18.920 --> 24:20.600 We're at step five. 24:20.600 --> 24:22.380 Visit the starter point. 24:22.380 --> 24:25.660 What are we doing on this website? 24:25.680 --> 24:33.960 Well, first we're trying to find information about the threat actors for our cyber threat intelligence scenario. 24:33.960 --> 24:37.660 So what areas of the wiki can help us? 24:37.660 --> 24:43.940 Well, we've got social networks, which, slight side note, this includes Facebook. 24:43.980 --> 24:52.560 And for the life of me, I cannot understand how a dot onion site for Facebook is not going against their own terms and policies. 24:52.560 --> 24:58.280 But also, if anybody could explain that to me, please, by all means, I would love to hear it. 24:58.280 --> 25:09.920 But I also personally wouldn't recommend signing into any of your real life social media accounts, especially at the same time as doing other things on the darknet. 25:09.920 --> 25:14.400 The whole point of this is to stay private, to try to stay anonymous. 25:14.740 --> 25:24.460 And if you're logging into your personal accounts and random accounts, or your personal accounts and your darknet accounts, it's possible that you could link those two. 25:24.460 --> 25:26.080 We want to try to avoid that. 25:26.080 --> 25:35.560 Similarly, if you're doing OSINT online and you're not using the darknet, but you're using maybe a virtual machine, you don't want to log into your own stuff in that instance. 25:35.940 --> 25:37.960 You could run into a conflict . 25:38.640 --> 25:41.240 Anyway, we have social media. 25:41.240 --> 25:47.120 We've got Connect, we've got Galaxy 3, which is rather new, we have Torbook, and we have Facebook somehow. 25:47.300 --> 25:53.400 Facebook I wouldn't necessarily consider a darknet social media, but it's there. 25:53.600 --> 25:57.080 Then we've got Hack, Freak, Anarchy, Warriors, Viruses, and Crack. 25:57.080 --> 25:59.380 We've got all of the stuff you need. 25:59.380 --> 26:02.600 Just try to rent a hacker, why don't you? 26:02.600 --> 26:07.740 Definitely isn't a scam, definitely is not going to backfire on you at all, promise. 26:10.000 --> 26:23.260 Do we think the threat actors that we are looking at for the industry, for our cyber threat intelligence scenario, are really taking any action here on these websites? 26:23.260 --> 26:30.680 Are they maybe selling their abilities or any code that they've made online? 26:30.820 --> 26:31.980 Maybe. 26:32.340 --> 26:38.520 Personally, I wouldn't think they'd be on these sites, but it's possible. 26:39.900 --> 26:44.800 You can definitely look into them, all depends on what you're trying to get into. 26:44.980 --> 26:51.360 Now, there's also another area, which is the introduction points. 26:51.660 --> 26:54.120 Earlier, I mentioned the search engines. 26:54.120 --> 27:02.460 Those are Google, DuckDuckGo, Bing, clear net search engines, awesome resources for clear net, for open source, all that good stuff. 27:02.780 --> 27:11.100 These are considered, in most cases, to be darknet search engines. 27:11.100 --> 27:15.660 Now, DuckDuckGo, we talked about, searches the clear net, but it's kind of working with Tor. 27:15.700 --> 27:20.620 We've got AMIA, which is searching Tor websites, but it's on the clear net. 27:20.700 --> 27:23.760 Then we've got stuff like Torch or NotEvil. 27:24.420 --> 27:32.560 If we wanted to go into these search engines and try to find more information on cyber threat intelligence, how would we start? 27:32.900 --> 27:34.980 Well, that's going to bring us to step six. 27:34.980 --> 27:36.480 Let's begin the hunt. 27:37.320 --> 27:38.780 This is NotEvil. 27:40.620 --> 27:48.880 FYI, this will probably get posted after, but if you try to go NotEvil, it may be down for an upgrade on August 7th. 27:49.080 --> 27:52.660 But otherwise, you can pretty much use this like Google. 27:52.660 --> 27:55.020 Put in some keywords and start searching. 27:55.280 --> 28:07.240 Now, I can tell you, but I will not show you, that when searching NotEvil for anything related to the pandemic, you get, surprise, surprise, a lot of pornography. 28:07.680 --> 28:10.600 Most searches will get you a lot of pornography. 28:11.780 --> 28:15.760 If we're being serious, that's just kind of how it is. 28:15.760 --> 28:30.100 You can tag videos and images and everything with anything, and it kind of works sometimes as a way of hiding actual posts and data, and sometimes it's just because people like to share it to each of their own. 28:30.100 --> 28:39.760 But as Pornhub stats can have shown in the past, when stuff is going on in day-to-day, you tend to see it turned into pornography and get really popular. 28:39.760 --> 28:44.840 So that's fine and dandy, but we're not going to show that here. 28:44.840 --> 28:47.880 Instead, what we're going to show is when I looked for hacker. 28:47.920 --> 28:49.020 Does stuff show up? 28:49.020 --> 28:49.940 Yes. 28:50.480 --> 28:51.780 We have some sites. 28:51.780 --> 28:53.520 We see some messages here. 28:54.380 --> 28:57.220 We see some posts down here. 28:57.220 --> 29:05.000 We have Vincent Canfield, a hacker on Keybase, who specifically says, do not chat messages on Keybase. 29:05.340 --> 29:06.280 Okay. 29:06.800 --> 29:08.720 We have The Social Hacker. 29:08.720 --> 29:11.580 We've got a warning on that site, check before purchasing. 29:11.580 --> 29:12.480 What are they selling? 29:12.480 --> 29:13.460 What's going on here? 29:13.460 --> 29:15.560 That's something we might want to look at. 29:16.740 --> 29:19.440 Now, what do we do if we search for cyber terrorists? 29:19.440 --> 29:23.180 Which is the next little block we have over here. 29:23.580 --> 29:24.820 Well, let's see. 29:25.060 --> 29:27.440 We've got Daniel's Onion List. 29:27.460 --> 29:28.280 That's cool. 29:28.280 --> 29:31.940 We've got some other languages that are popping up here. 29:31.940 --> 29:33.120 That's nice. 29:33.360 --> 29:35.350 Look, we have a mention of the CIA. 29:35.880 --> 29:36.920 Okay. 29:37.060 --> 29:38.760 We've got Rat Wires. 29:38.760 --> 29:39.160 All right. 29:39.160 --> 29:40.320 Interesting. 29:40.320 --> 29:49.160 So we get a few hits, but is a cyber terrorist group going to label themselves a cyber terrorist group? 29:49.520 --> 29:50.600 Maybe. 29:50.800 --> 29:53.220 Cyber terrorism is kind of a perspectives game. 29:53.220 --> 29:55.920 Most things are a perspective game, really, right? 29:55.980 --> 30:04.020 If I'm looking for information about someone that I think has done something bad, I think they've done something bad. 30:04.020 --> 30:06.420 They might think they're doing something good. 30:06.480 --> 30:07.800 Are they a hacktivist? 30:07.800 --> 30:09.720 How do we decide that? 30:09.800 --> 30:14.640 That's another thing we'll need to use some cyber threat intelligence skills and techniques to deal with. 30:15.260 --> 30:19.180 But let's get back to the next step. 30:19.180 --> 30:20.060 Part 7. 30:20.060 --> 30:21.440 Part of the talk. 30:21.680 --> 30:26.440 Websites on TOR can and are volatile. 30:26.820 --> 30:29.060 TORM may be up one day and down the next. 30:29.060 --> 30:35.680 Now, TORM is a great website for getting into the cyber security community on TORM. 30:35.680 --> 30:37.680 It's a very interesting forum. 30:37.680 --> 30:45.940 They got that traditional sweet, sweet terminal green on black going on, so it may or may not hurt your eyes. 30:46.720 --> 30:54.040 I would love to show you a picture of it, but when I went to get all the pictures, as per the slide mentioning, TORM was down. 30:54.160 --> 30:56.360 And that doesn't mean TORM is gone forever. 30:56.360 --> 31:01.800 Most likely it means it was down for maintenance or maybe they had a weather issue or some other issue wherever it's being hosted. 31:02.300 --> 31:03.540 It is what it is. 31:03.540 --> 31:05.520 But this can make communication difficult. 31:05.520 --> 31:10.880 And if you aren't embedded, you can easily lose track of things, if not be left behind completely. 31:11.340 --> 31:19.960 So there is a point at which we may want to talk about how do you safely integrate into the communities to get more information. 31:20.360 --> 31:23.120 You're already having a hard time searching the darknet. 31:23.660 --> 31:28.220 Is there a point at which you want to embed yourself in communities to start learning more? 31:28.220 --> 31:29.440 Is it safe to do? 31:29.440 --> 31:30.800 How do you do it safely? 31:30.800 --> 31:37.060 These are all really great questions that we don't really have time to get into today, but keep an eye out. 31:37.060 --> 31:41.640 This is definitely something I want to talk about with everyone more going forward. 31:42.980 --> 31:45.160 So summary slide, right? 31:45.160 --> 31:47.100 Cyberthreat intelligence on the darknet. 31:47.100 --> 31:52.840 All right, so on the clear net, in parts of the deep web, we can go through profiles, web pages, pretty quickly. 31:53.340 --> 31:54.000 What do we say? 31:54.000 --> 31:57.820 Like a minute to find a page on Google, give or take. 31:57.900 --> 32:02.240 About five, up to five minutes for the deep web if you're just doing a shallow dive. 32:02.240 --> 32:03.420 Not too bad. 32:03.800 --> 32:05.520 Darknet's different though, huh? 32:05.660 --> 32:14.040 Although there are some tools in place, such as darknet search engines, like not evil, we don't have the same boosters here as we do everywhere else. 32:14.040 --> 32:15.360 It's not quite as easy. 32:15.360 --> 32:17.160 It's not quite as indexed. 32:17.520 --> 32:21.160 And this is something we take advantage of in our day-to-day lives. 32:21.160 --> 32:29.540 A lot of us may even forget a time or not have been alive during a time before Google, before these things were indexed and easy to find. 32:30.960 --> 32:34.560 So if we're trying to do darknet research, there's a huge bottleneck here. 32:34.560 --> 32:38.320 If you're doing manual investigations, that's a slow process. 32:38.320 --> 32:42.640 And getting to websites and finding websites, it's the game of the darknet. 32:42.640 --> 32:44.060 You got to trade stuff, right? 32:44.060 --> 32:47.260 You've got to interact to really dig in and find these. 32:47.780 --> 32:52.600 It's a huge hurdle when trying to hunt for cyber threat intelligence on the darknet. 32:53.620 --> 32:55.580 And this is where Ambly comes in. 32:55.580 --> 33:01.780 And I'm really excited that we've gotten to this part because this is a project that I have been hoping to work on for a long time. 33:01.860 --> 33:06.700 And when I finally got the chance to do it with the SAIL lab, I think I just about lost my mind. 33:06.700 --> 33:07.860 I was so excited. 33:08.020 --> 33:12.340 So taking a step back, let's talk a little bit about Ambly. 33:12.440 --> 33:18.160 Ambly is a smart spider focused on the darknet to gather and identify cyber threat intelligence. 33:18.460 --> 33:33.940 Ambly is going to be using some machine learning and artificial intelligence techniques to actually identify relevant websites and to make sure that they're valid and they're pertaining to cyber threat intelligence. 33:34.380 --> 33:41.600 We're going to be accessing websites hopefully down the line behind capture blocks or user accounts and anti-robot protocols. 33:41.880 --> 33:49.380 The goal here is to use deep learning and natural language processing to identify and rank new URLs based on the potential for CTI. 33:49.400 --> 34:07.420 We're going to hopefully have a report that gives us out webpages and identifies further investigation recommendations so that an analyst, government, researchers, whatever, what have you, can actually use this to get rid of or to reduce that bottleneck that we talked about a moment ago. 34:08.180 --> 34:12.460 Reducing the bottleneck is the key behind Ambly's mission here. 34:12.460 --> 34:17.320 We want to make this easier and better and not just for cyber threat intelligence. 34:17.320 --> 34:23.440 There's other tools that may or may not be in the works here, but this is the goal of Ambly. 34:23.440 --> 34:29.060 Ambly is for cyber threat intelligence to identify and track this information on the dark net. 34:29.400 --> 34:33.220 Right now, specifically Tor, but that does not mean it's limited. 34:33.680 --> 34:35.180 But let's take a step back. 34:35.560 --> 34:38.080 That's what the Ambly we want. 34:38.180 --> 34:41.120 We want to be able to do a lot of stuff with Ambly. 34:41.120 --> 34:43.080 But where are we right now? 34:43.260 --> 34:47.920 Well, Ambly is in a prototype stage and we'll get to that in a minute. 34:48.420 --> 34:51.800 But right now, Ambly is going out and gathering data. 34:51.800 --> 35:01.080 Ambly is actually creating a database on viable dark net websites, specifically on Tor, so they're all .onion sites. 35:01.260 --> 35:03.480 So how does Ambly do that? 35:03.660 --> 35:06.160 Imagine, if you will, another scenario. 35:06.480 --> 35:08.400 You dropped in a random city. 35:08.640 --> 35:10.400 You don't know where you are. 35:10.760 --> 35:14.860 You don't know what country, state, city, anything. 35:14.860 --> 35:20.500 You don't have a phone, you don't have a computer, and you don't know the language of the people around you. 35:21.080 --> 35:22.580 What do you do? 35:22.820 --> 35:24.520 How do you find safety? 35:24.520 --> 35:25.940 How do you get home? 35:26.440 --> 35:41.080 Well, personally, I would start walking, searching for any sign of a police station, of some trusted resource that I can go to for help. 35:42.160 --> 35:48.580 Now, maybe there's this universal sign that we'll see, or some sign that'll help me indicate that path. 35:48.580 --> 35:50.820 Maybe there's not, and maybe I just have to walk. 35:50.940 --> 35:56.740 And I go down a path, and I keep following that in any way it leads, and if it doesn't work, I go back. 35:56.880 --> 36:02.760 And we keep doing that almost recursive spin around until we find an area that we need to be in. 36:03.240 --> 36:08.580 This is kind of what Ambly is doing, to create that initial data set on Darknet websites. 36:08.580 --> 36:10.620 It's just going. 36:11.140 --> 36:12.300 It's free to move. 36:12.300 --> 36:14.140 It's collecting websites. 36:14.140 --> 36:26.960 It's identifying and collecting a whole database on Darknet websites, when they were viable, verifying that we could actually go to the site, not only that the link was out there. 36:27.500 --> 36:33.660 And from there, we're going to use that data to start doing really cool things with machine learning. 36:34.520 --> 36:37.240 But let's talk about Ambly of today. 36:37.740 --> 36:41.520 All right, so we're in a prototype stage, like I mentioned. 36:41.620 --> 36:45.940 We're beginning to be on active and frequently updated Tor wikis. 36:45.940 --> 36:48.500 Not the one I showed you earlier, but a different one. 36:48.500 --> 36:52.040 One that's really up to date and monitored frequently. 36:52.300 --> 36:54.480 We've got two access points that Ambly has. 36:54.480 --> 36:56.680 One, instantly on the Darknet. 36:56.680 --> 37:01.420 Anything that goes through any search, any website, we're going to the Darknet connection point. 37:01.420 --> 37:07.560 This makes sure that we are always connected to one of the nodes and it keeps us in the network. 37:07.560 --> 37:17.200 So even if, by chance, and early on we ran into this, where maybe we found a Clearnet website, going to that site still used the Darknet IP addresses. 37:17.440 --> 37:25.340 We've now since removed the ability to go to Clearnet sites, as the focus here is on Darknet only or .onion sites. 37:26.500 --> 37:34.640 The second connection is to the Clearnet for the actual database storage, which currently is a MongoDB Atlas format. 37:35.140 --> 37:36.700 We'll talk about that in a minute. 37:37.180 --> 37:41.780 Now the crawls gather HTML, which includes URLs and text. 37:41.780 --> 37:44.300 The URLs are parsed out and stored separately. 37:44.540 --> 37:47.220 The text is parsed out and stored separately as well. 37:47.220 --> 37:51.700 And then the HTML is stored as is, but in a binary format. 37:52.080 --> 37:57.240 At no point, and this is very important, at no point are images specifically pulled. 37:57.940 --> 38:12.600 Illicit materials are avoided and are not meant to be interacted with, including and especially CSAM, which is a term that's used frequently for people who are working on anti-human trafficking and child pornography rings. 38:12.600 --> 38:21.100 This is specifically about sensitive materials regarding children that we do not want out there. 38:21.780 --> 38:24.260 We are not collecting that with Ambly. 38:24.320 --> 38:29.040 You may see on the HTML that an image was there, but the image itself is not pulled. 38:29.620 --> 38:33.000 Now the database, like I mentioned, is a MongoDB Atlas. 38:33.240 --> 38:38.420 It is file sizes identified at the pull and marked so that we don't go over the limit. 38:38.420 --> 38:39.460 We did go over that. 38:39.460 --> 38:41.320 We'll see that in the next slide. 38:41.460 --> 38:46.040 The format of the data is important for avoiding those document limits. 38:46.040 --> 38:47.820 Again, we'll talk about that. 38:48.100 --> 38:51.440 And Ambly runs in a digital ocean droplet. 38:52.260 --> 38:55.720 All right, Ambly's first 12 hours. 38:56.140 --> 39:04.000 So, first 12 hours that we ran Ambly Prototype Stage 1, we had MongoDB Atlas and local. 39:04.000 --> 39:08.020 We found they both have a limited size of 16 megabytes per document. 39:08.200 --> 39:11.680 And this is what broke our cycle. 39:11.680 --> 39:22.840 The reason for that is originally the text was in an unbounded array format, which just extended too large for certain websites to actually be collected. 39:22.960 --> 39:26.120 So, what you'll see here is the first 12 hours of Ambly. 39:26.220 --> 39:32.180 We collected, in 12 hours, 86,546 websites. 39:32.540 --> 39:40.360 We got 1,819, rather, HTML pulled from those sites. 39:40.360 --> 39:43.740 And the text we got to 1,818. 39:43.740 --> 39:49.080 On the 19th is when we got the limit size was hit. 39:49.140 --> 39:50.900 That has since been rectified. 39:51.020 --> 39:56.200 But just imagine this, the first 12 hours, we got so many URLs. 39:56.680 --> 40:02.260 People talk about all the time that the dark net is small. 40:02.460 --> 40:08.680 And it is compared to the clear net, compared to the deep net, sure, but it is not tiny. 40:08.800 --> 40:11.640 There are so many URLs and websites out there. 40:11.640 --> 40:21.860 And this is specifically specifically designed to make sure that no two websites are pulled with the same URL. 40:21.860 --> 40:28.140 So, even if two sites link to the same website or webpage, only one of them, the first one, is stored. 40:28.140 --> 40:29.620 The other is dropped. 40:30.080 --> 40:38.060 That is 86,546 unique URLs pulled in the first 12 hours. 40:38.680 --> 40:42.320 I don't know about you, but I was ecstatic to see that. 40:43.020 --> 40:44.840 So, let's get into the good stuff. 40:44.840 --> 40:47.440 Let's talk about some initial points of interest. 40:47.740 --> 40:52.800 We've got a few pulls that I went in and I grabbed some interesting sites from. 40:53.720 --> 41:04.700 The fourth website to be pulled after going to the Tor Wiki was the Liberated Books and Papers site, which claims to be a collection of books not easy to come by. 41:05.180 --> 41:17.600 Our sixth website crawled was an error page for WordPress, which actually helped show that WordPress sites are being used on the Darknet under the name of Torpress, which is really interesting. 41:17.600 --> 41:20.180 You can actually see that in the URL. 41:20.860 --> 41:27.440 Thirty-two, we found the TMG Mirror List, also known as the Majestic Garden. 41:27.440 --> 41:32.360 This has a PGP for joining the Majestic Garden group. 41:32.360 --> 41:42.040 And there were multiple, not just these three, there were even more of these URLs that had the exact same thing on them, which brought up a very interesting question. 41:42.040 --> 41:45.220 What do we do about sites that are so similar? 41:45.320 --> 41:52.360 If they all have the same stuff, but they're just a different URL, do we count them as one entity or combine them? 41:52.680 --> 41:53.660 We'll see. 41:54.040 --> 41:54.320 All right. 41:54.320 --> 41:58.820 Sixty-first website crawled, Relate List, new area of intelligence. 41:58.820 --> 42:02.120 Really interesting for looking up information on companies. 42:03.100 --> 42:06.400 I'm going to skip ahead a little bit because I'm seeing we're short on time. 42:06.400 --> 42:07.960 So let's go into this. 42:07.960 --> 42:09.440 Initial points of contact. 42:09.440 --> 42:12.140 This is how we see the URLs. 42:12.720 --> 42:19.820 We see that the URLs are all stored, we see if it's visited or not, and this is the binary format for the HTML. 42:20.220 --> 42:26.640 We crawled a lot of sites, the Wiki, Bitcoin wallets, marketplaces, resellers, you name it, we saw it. 42:26.640 --> 42:27.820 It was great. 42:28.120 --> 42:30.840 And we still have all of this data to go through. 42:31.640 --> 42:37.400 A few other interesting ones is the black and white cards, which is a mysterious group open to members. 42:37.500 --> 42:40.340 This one was really interesting just to read through. 42:41.840 --> 42:53.440 We also have Rent-A-Hacker, which I don't know if anybody else has noticed this, but there's about five, at minimum, versions of this website under different names and different URLs that say pretty much the exact same thing. 42:54.300 --> 42:55.960 So this is pretty much a mirror. 42:56.480 --> 42:58.440 Very minor, if any, edits. 42:58.700 --> 43:01.740 But if you need a hacker, I wouldn't go to this one. 43:03.260 --> 43:06.200 Again, you're at DEF CON, so really, you need to go to them. 43:06.320 --> 43:08.780 Now, Ambley of tomorrow. 43:09.440 --> 43:13.240 As a prototype, Ambley is on a road of continuous change. 43:13.660 --> 43:17.380 There's a few areas that we want to get down on Ambley's development. 43:17.480 --> 43:35.200 One, integrate a new classifier, PermID, currently working on it, that will help Ambley's crawl to classify webpages during the initial crawl itself, telling us is this relevant to cyber threat intelligence, is it relevant to cybersecurity, drugs, bitcoins, 43:35.200 --> 43:36.220 you tell me. 43:36.800 --> 43:44.460 Now, then we want to be able to identify webpages with CAPTCHA, which we've found a few, test the CAPTCHA breaker component that I'm also working on. 43:44.460 --> 43:50.720 This includes specialized CAPTCHA found on TOR sites, like this gorgeous DREAD CAPTCHA. 43:50.960 --> 44:06.440 DREAD's CAPTCHA methods are both magic beauties, they're beautiful, I can't speak to them, but they're also horrendous to actually deal with as a person. 44:06.540 --> 44:09.180 This one's nicer than the old one. 44:09.220 --> 44:17.000 Finally, we want to implement a deep learning module using natural language processing to identify relevant links to prioritize. 44:17.700 --> 44:19.160 This is really great. 44:19.160 --> 44:24.280 I'm really excited about getting that part up and running, and that's really the big next stage. 44:24.960 --> 44:27.040 But that's all I have time for today. 44:27.040 --> 44:29.980 I'm running out of, I'm pretty much at my limit. 44:29.980 --> 44:38.900 So, unfortunately, I'm sorry I had to run a little fast at the end, but thank you so much, DEF CON, and the recon village, and everyone who's came in today to watch this. 44:38.900 --> 44:41.660 Thank you so much for spending some time with me. 44:41.660 --> 44:50.440 I also want to say I'm thankful for the Sailors of the Secure and Assured Intelligence Learning Lab that I work with, and the KDD team of Kansas State University. 44:50.740 --> 44:57.960 Finally, I volunteer with the Innocent Lives Foundation, and I really wanted to just shout them out here at the last few seconds. 44:57.960 --> 45:00.660 I really hope you give them a look, they're great. 45:00.940 --> 45:08.080 And part of why I'm so passionate about this is because I get to work with them, not specifically on this project, but on others. 45:08.420 --> 45:16.700 I really hope anybody who wants to reach out does, my social media is on this video, and let's chat, let's talk some Tor. 45:16.960 --> 45:18.460 Thanks again, everybody. 45:18.460 --> 45:20.620 Have a great rest of DEF CON.