1
00:00:00,160 --> 00:00:02,000
the director of threat intelligence at

2
00:00:02,000 --> 00:00:04,319
abnormal security where he leads a team

3
00:00:04,319 --> 00:00:06,000
responsible for researching enterprise

4
00:00:06,000 --> 00:00:08,160
focused cyber threats particularly

5
00:00:08,160 --> 00:00:10,639
business email compromise and credential

6
00:00:10,639 --> 00:00:12,000
phishing attacks

7
00:00:12,000 --> 00:00:13,679
prior to moving to the private sector in

8
00:00:13,679 --> 00:00:16,160
2015 crane served as an analyst at the

9
00:00:16,160 --> 00:00:19,279
fbi for more than 11 years spending most

10
00:00:19,279 --> 00:00:21,279
of his career in the behavioral analysis

11
00:00:21,279 --> 00:00:23,439
units providing support to intelligence

12
00:00:23,439 --> 00:00:25,199
community and law enforcement partners

13
00:00:25,199 --> 00:00:26,080
against

14
00:00:26,080 --> 00:00:28,480
various against national security

15
00:00:28,480 --> 00:00:31,679
adversaries and serial violent criminals

16
00:00:31,679 --> 00:00:33,920
had a busy job

17
00:00:33,920 --> 00:00:36,719
in 2012 crane helped create the fbi

18
00:00:36,719 --> 00:00:38,399
cyber behavioral analysis center which

19
00:00:38,399 --> 00:00:39,920
combines the traditional behavioral

20
00:00:39,920 --> 00:00:42,320
concepts used for decades in the violent

21
00:00:42,320 --> 00:00:44,640
crime world with technical expertise to

22
00:00:44,640 --> 00:00:46,719
gain a holistic understanding of cyber

23
00:00:46,719 --> 00:00:48,800
adversary ttps

24
00:00:48,800 --> 00:00:50,800
so please welcome crain hassell who will

25
00:00:50,800 --> 00:00:53,120
be speaking on social engineering these

26
00:00:53,120 --> 00:00:55,440
social engineers understanding fishing

27
00:00:55,440 --> 00:00:58,000
threats by engaging with actors take it

28
00:00:58,000 --> 00:01:00,800
away crane all right

29
00:01:00,800 --> 00:01:02,079
first of all i can't tell you how

30
00:01:02,079 --> 00:01:04,479
excited i am for this presentation i've

31
00:01:04,479 --> 00:01:06,000
been wanting to give this presentation

32
00:01:06,000 --> 00:01:08,479
here for three years uh i remember

33
00:01:08,479 --> 00:01:09,439
leaving

34
00:01:09,439 --> 00:01:11,600
uh social engineering village in 2019

35
00:01:11,600 --> 00:01:13,920
being like i have a perfect idea i'm

36
00:01:13,920 --> 00:01:16,479
gonna submit this for 2020

37
00:01:16,479 --> 00:01:19,280
and then you know covet happened and uh

38
00:01:19,280 --> 00:01:21,040
so it wasn't until finally this year

39
00:01:21,040 --> 00:01:22,720
everyone's back in person i can see

40
00:01:22,720 --> 00:01:25,280
people i can feed off of people

41
00:01:25,280 --> 00:01:27,200
i'm so excited for this presentation so

42
00:01:27,200 --> 00:01:28,799
what we're going to talk about today is

43
00:01:28,799 --> 00:01:30,720
you know when we talk about phishing

44
00:01:30,720 --> 00:01:32,479
attacks when we talk about cyber attacks

45
00:01:32,479 --> 00:01:33,920
you know most people there's a big

46
00:01:33,920 --> 00:01:35,280
perception out there that these are

47
00:01:35,280 --> 00:01:36,880
technical things right and i think that

48
00:01:36,880 --> 00:01:38,400
most people here know

49
00:01:38,400 --> 00:01:40,079
that for the most part phishing threats

50
00:01:40,079 --> 00:01:41,759
are nothing more than

51
00:01:41,759 --> 00:01:44,000
exploiting human behavior um and when

52
00:01:44,000 --> 00:01:45,759
you look at some of the specific types

53
00:01:45,759 --> 00:01:46,960
of cyber threats that are out there

54
00:01:46,960 --> 00:01:49,119
today there are some really interesting

55
00:01:49,119 --> 00:01:51,119
ways that we can collect intelligence

56
00:01:51,119 --> 00:01:52,960
and better understand these these

57
00:01:52,960 --> 00:01:54,720
threats uh that are a little bit

58
00:01:54,720 --> 00:01:56,320
different than other types of attacks

59
00:01:56,320 --> 00:01:57,520
out there

60
00:01:57,520 --> 00:01:58,479
so

61
00:01:58,479 --> 00:01:59,920
usually when i give this presentation i

62
00:01:59,920 --> 00:02:01,040
give a little background about business

63
00:02:01,040 --> 00:02:02,640
email compromise what it is how big of a

64
00:02:02,640 --> 00:02:04,479
problem it is i'm not gonna go into that

65
00:02:04,479 --> 00:02:05,920
today i'm sure most people here know

66
00:02:05,920 --> 00:02:08,720
about it but bec it's a problem causes

67
00:02:08,720 --> 00:02:11,360
billions of dollars of loss easily the

68
00:02:11,360 --> 00:02:13,520
most financially impactful threat that's

69
00:02:13,520 --> 00:02:14,800
out there today

70
00:02:14,800 --> 00:02:17,520
um and so it's a it's a problem right

71
00:02:17,520 --> 00:02:19,440
but what's unique about business email

72
00:02:19,440 --> 00:02:21,440
compromise is that in order for it to be

73
00:02:21,440 --> 00:02:24,080
successful it requires an actual

74
00:02:24,080 --> 00:02:25,760
interaction and communication back and

75
00:02:25,760 --> 00:02:27,840
forth with a victim unlike things like

76
00:02:27,840 --> 00:02:30,560
credential phishing or malware attacks

77
00:02:30,560 --> 00:02:32,400
where it's essentially they send out

78
00:02:32,400 --> 00:02:34,160
campaigns waiting for someone to click

79
00:02:34,160 --> 00:02:36,400
on a link or open a payload it's very

80
00:02:36,400 --> 00:02:37,920
different with bec in order to get

81
00:02:37,920 --> 00:02:40,319
someone to wired money to a supposed

82
00:02:40,319 --> 00:02:42,400
vendor there has to be a little back and

83
00:02:42,400 --> 00:02:44,160
forth communication there and that's a

84
00:02:44,160 --> 00:02:46,239
point where we can actually

85
00:02:46,239 --> 00:02:48,800
interject into those conversations and

86
00:02:48,800 --> 00:02:50,319
start collecting some additional

87
00:02:50,319 --> 00:02:51,840
intelligence

88
00:02:51,840 --> 00:02:53,120
this is something that we call active

89
00:02:53,120 --> 00:02:55,040
defense and so my definition for active

90
00:02:55,040 --> 00:02:57,040
defense is essentially interacting with

91
00:02:57,040 --> 00:02:58,879
an attack or an attacker for the

92
00:02:58,879 --> 00:03:00,800
purposes of collecting intelligence that

93
00:03:00,800 --> 00:03:03,440
helps us better understand that threat

94
00:03:03,440 --> 00:03:04,800
and that could include things like

95
00:03:04,800 --> 00:03:07,440
engaging with bec actors seeding fishing

96
00:03:07,440 --> 00:03:09,519
sites or embedding beacons in our

97
00:03:09,519 --> 00:03:11,599
communications

98
00:03:11,599 --> 00:03:14,400
and so in practice this is sort of how

99
00:03:14,400 --> 00:03:17,519
it goes in an active defense engagement

100
00:03:17,519 --> 00:03:19,760
if a bc actor says can you send a new

101
00:03:19,760 --> 00:03:22,000
payment to a vendor our response to them

102
00:03:22,000 --> 00:03:23,840
is sure

103
00:03:23,840 --> 00:03:25,680
if they say can you directly update my

104
00:03:25,680 --> 00:03:27,760
direct deposit information we say no

105
00:03:27,760 --> 00:03:28,959
problem

106
00:03:28,959 --> 00:03:30,480
they say can you go out and buy three

107
00:03:30,480 --> 00:03:32,159
thousand dollars of apple itunes gift

108
00:03:32,159 --> 00:03:34,959
cards we say i'll run out in a few

109
00:03:34,959 --> 00:03:36,560
and if they say something like can you

110
00:03:36,560 --> 00:03:38,640
send me a copy of an aging report with

111
00:03:38,640 --> 00:03:40,959
all of our customers contact information

112
00:03:40,959 --> 00:03:42,400
we'll say we'll get it to you by closing

113
00:03:42,400 --> 00:03:44,319
business right so essentially we're just

114
00:03:44,319 --> 00:03:46,319
complying with whatever they're saying

115
00:03:46,319 --> 00:03:47,680
that's essentially how a lot of these

116
00:03:47,680 --> 00:03:49,200
active defense engagements get kicked

117
00:03:49,200 --> 00:03:51,280
off and then once they get kicked off we

118
00:03:51,280 --> 00:03:52,799
sort of run them

119
00:03:52,799 --> 00:03:53,920
until really they're they're

120
00:03:53,920 --> 00:03:55,760
extinguished until we sort of run them

121
00:03:55,760 --> 00:03:58,239
into the ground sometimes that takes 24

122
00:03:58,239 --> 00:04:00,000
hours sometimes as you'll see here in a

123
00:04:00,000 --> 00:04:02,640
little bit that could take months

124
00:04:02,640 --> 00:04:03,599
and so

125
00:04:03,599 --> 00:04:05,200
why do we do this what are the you know

126
00:04:05,200 --> 00:04:06,879
what's the reason that we do that we run

127
00:04:06,879 --> 00:04:09,040
these active defense engagements and one

128
00:04:09,040 --> 00:04:11,040
of the biggest reasons is it helps us

129
00:04:11,040 --> 00:04:13,599
understand the full bc attack cycle

130
00:04:13,599 --> 00:04:15,760
we're not just relying on that initial

131
00:04:15,760 --> 00:04:17,839
email to provide us information to

132
00:04:17,839 --> 00:04:19,600
understand the tactics and the

133
00:04:19,600 --> 00:04:21,759
techniques of the adversary we're able

134
00:04:21,759 --> 00:04:23,840
to sort of see what happens after an

135
00:04:23,840 --> 00:04:25,280
attack is successful we're essentially

136
00:04:25,280 --> 00:04:27,199
simulating a successful attack we're

137
00:04:27,199 --> 00:04:29,520
able to see things like uh post-attack

138
00:04:29,520 --> 00:04:31,680
behavior understanding how that

139
00:04:31,680 --> 00:04:34,240
interaction is gonna go after someone uh

140
00:04:34,240 --> 00:04:36,080
after someone responds to it

141
00:04:36,080 --> 00:04:37,040
one of the other things that it's

142
00:04:37,040 --> 00:04:38,720
helpful for is identifying things like

143
00:04:38,720 --> 00:04:40,000
fraudulent mule accounts where they

144
00:04:40,000 --> 00:04:41,680
where a lot of these actors want money

145
00:04:41,680 --> 00:04:43,040
to be sent whether it's something like a

146
00:04:43,040 --> 00:04:45,360
payroll diversion attack or a payment

147
00:04:45,360 --> 00:04:48,080
fraud bec attack one of the great things

148
00:04:48,080 --> 00:04:50,320
about these engagements

149
00:04:50,320 --> 00:04:52,160
is we're able to understand

150
00:04:52,160 --> 00:04:54,320
what at the time of these engagements

151
00:04:54,320 --> 00:04:57,040
exactly that the actors think and

152
00:04:57,040 --> 00:04:58,720
believe that the accounts they're

153
00:04:58,720 --> 00:05:00,720
providing to us are actually being able

154
00:05:00,720 --> 00:05:03,680
to be used in that instance uh for for

155
00:05:03,680 --> 00:05:05,120
fraudulent purposes and so one of the

156
00:05:05,120 --> 00:05:06,960
things that we do on my team is we

157
00:05:06,960 --> 00:05:09,440
actually work directly with financial

158
00:05:09,440 --> 00:05:11,120
institutions and

159
00:05:11,120 --> 00:05:13,280
major organizations like fsisac to

160
00:05:13,280 --> 00:05:15,600
provide all of these mule accounts in

161
00:05:15,600 --> 00:05:18,080
real time to these organizations

162
00:05:18,080 --> 00:05:20,320
hopefully to minimize the effective

163
00:05:20,320 --> 00:05:21,759
lifespan of these accounts because one

164
00:05:21,759 --> 00:05:23,840
of the things with bec is because it's

165
00:05:23,840 --> 00:05:26,080
so big and there are so many actors out

166
00:05:26,080 --> 00:05:28,720
there that you can't possibly arrest

167
00:05:28,720 --> 00:05:31,120
yourself the rest your way out of this

168
00:05:31,120 --> 00:05:33,280
problem um and you have to think about

169
00:05:33,280 --> 00:05:34,560
think and sort of think outside the box

170
00:05:34,560 --> 00:05:36,560
about how we can impact things like bec

171
00:05:36,560 --> 00:05:37,919
and the financial supply chain i think

172
00:05:37,919 --> 00:05:39,440
is really one of the ways that we can do

173
00:05:39,440 --> 00:05:40,720
that

174
00:05:40,720 --> 00:05:42,080
so we're also able to supplement

175
00:05:42,080 --> 00:05:44,479
attacker attribution so we embed beacons

176
00:05:44,479 --> 00:05:46,160
in each one of our communications that

177
00:05:46,160 --> 00:05:48,080
provides us some high level attribution

178
00:05:48,080 --> 00:05:50,080
that usually about 20 25 percent of the

179
00:05:50,080 --> 00:05:52,800
time gives us a good non-proxy ip

180
00:05:52,800 --> 00:05:54,639
address that can that allows us to sort

181
00:05:54,639 --> 00:05:56,000
of understand where these actors are

182
00:05:56,000 --> 00:05:57,280
coming from

183
00:05:57,280 --> 00:05:58,880
and then as we'll see here a little bit

184
00:05:58,880 --> 00:06:01,520
later one of the things that from a from

185
00:06:01,520 --> 00:06:04,160
a pure behavioral perspective that doing

186
00:06:04,160 --> 00:06:05,919
these engagements also at some at some

187
00:06:05,919 --> 00:06:08,160
point allows us to better understand the

188
00:06:08,160 --> 00:06:10,240
motivations behind these attacks

189
00:06:10,240 --> 00:06:12,479
understand why these actors are doing

190
00:06:12,479 --> 00:06:15,039
what they're doing

191
00:06:15,039 --> 00:06:16,319
and so at the end of the day you know

192
00:06:16,319 --> 00:06:17,919
why does this work you know why does

193
00:06:17,919 --> 00:06:19,440
active defense work why do they engage

194
00:06:19,440 --> 00:06:22,160
these engagements give us the uh give us

195
00:06:22,160 --> 00:06:23,600
the information that we're looking for

196
00:06:23,600 --> 00:06:25,759
you know from a success perspective we

197
00:06:25,759 --> 00:06:28,639
get to have about a 60 65 success rate

198
00:06:28,639 --> 00:06:30,800
in our active defense engagements and of

199
00:06:30,800 --> 00:06:34,720
the 30 to 30 35 that aren't successful

200
00:06:34,720 --> 00:06:36,880
uh we know that most of the accounts are

201
00:06:36,880 --> 00:06:38,880
dead by the time we we start them and

202
00:06:38,880 --> 00:06:40,400
then we also know that there's a very

203
00:06:40,400 --> 00:06:42,560
small percentage of actors out there

204
00:06:42,560 --> 00:06:43,919
that are actually paying attention to

205
00:06:43,919 --> 00:06:45,680
who they're communicating with right so

206
00:06:45,680 --> 00:06:47,199
at any time in these campaigns they're

207
00:06:47,199 --> 00:06:49,680
sending out dozens if not hundreds of

208
00:06:49,680 --> 00:06:52,560
emails manually and they're usually not

209
00:06:52,560 --> 00:06:53,840
paying attention to who actually

210
00:06:53,840 --> 00:06:55,840
responds back to them

211
00:06:55,840 --> 00:06:58,720
so why does this work so at its core

212
00:06:58,720 --> 00:07:00,560
scammers are people too they're human

213
00:07:00,560 --> 00:07:02,560
beings and they can be exploited just

214
00:07:02,560 --> 00:07:05,280
like they're victims and you know this

215
00:07:05,280 --> 00:07:07,199
works because as long as human beings

216
00:07:07,199 --> 00:07:09,280
have been on this earth as long as we've

217
00:07:09,280 --> 00:07:11,440
been communicating with each other we've

218
00:07:11,440 --> 00:07:12,880
been social engineering each other the

219
00:07:12,880 --> 00:07:14,720
only difference is now with cases like

220
00:07:14,720 --> 00:07:16,960
this we're doing it through a computer

221
00:07:16,960 --> 00:07:18,400
over the internet through email instead

222
00:07:18,400 --> 00:07:19,840
of doing it face to face or over the

223
00:07:19,840 --> 00:07:22,000
phone or or through the mail or

224
00:07:22,000 --> 00:07:23,039
something like that but the same

225
00:07:23,039 --> 00:07:24,240
concepts that have been used for

226
00:07:24,240 --> 00:07:26,240
literally thousands of years are the

227
00:07:26,240 --> 00:07:28,639
exact same reasons uh that that things

228
00:07:28,639 --> 00:07:30,400
like this are successful

229
00:07:30,400 --> 00:07:32,880
and so the same social engineering

230
00:07:32,880 --> 00:07:35,520
principles that they use to con their

231
00:07:35,520 --> 00:07:37,759
own victims are the exact same reasons

232
00:07:37,759 --> 00:07:39,840
that we're able to extract information

233
00:07:39,840 --> 00:07:42,000
from them and one of the biggest reasons

234
00:07:42,000 --> 00:07:44,319
for this is because these attacks are

235
00:07:44,319 --> 00:07:46,560
highly financially motivated and because

236
00:07:46,560 --> 00:07:48,479
they're highly financially motivated as

237
00:07:48,479 --> 00:07:51,840
long as they have a slight belief that

238
00:07:51,840 --> 00:07:53,919
they're going to make some money out of

239
00:07:53,919 --> 00:07:56,319
these these uh these this communication

240
00:07:56,319 --> 00:07:58,400
they're going to keep keep going on with

241
00:07:58,400 --> 00:07:59,840
that with that with that line of uh

242
00:07:59,840 --> 00:08:01,440
questioning and so what's really

243
00:08:01,440 --> 00:08:03,199
interesting is it also over reads

244
00:08:03,199 --> 00:08:06,400
overrides some of the red flags that you

245
00:08:06,400 --> 00:08:08,479
would think would probably come up in

246
00:08:08,479 --> 00:08:10,879
some of these engagements and this is uh

247
00:08:10,879 --> 00:08:12,560
sort of a great example of that so this

248
00:08:12,560 --> 00:08:13,520
is a

249
00:08:13,520 --> 00:08:14,879
an active defense engagement that i

250
00:08:14,879 --> 00:08:16,879
tweeted out a couple of years ago

251
00:08:16,879 --> 00:08:19,280
that lasted for two weeks

252
00:08:19,280 --> 00:08:20,800
i was back and forth with this guy for

253
00:08:20,800 --> 00:08:23,840
two weeks and exchanged more than 100

254
00:08:23,840 --> 00:08:26,560
100 emails with this scammer

255
00:08:26,560 --> 00:08:30,479
collected 22 mule accounts came up with

256
00:08:30,479 --> 00:08:33,279
a couple dozen different excuses about

257
00:08:33,279 --> 00:08:35,279
why a payment wouldn't work and i'll

258
00:08:35,279 --> 00:08:36,719
tell you that's actually one of the more

259
00:08:36,719 --> 00:08:39,200
challenging parts of doing this at scale

260
00:08:39,200 --> 00:08:41,599
is coming up with excuses um you know at

261
00:08:41,599 --> 00:08:43,519
some point in this uh in this engagement

262
00:08:43,519 --> 00:08:45,519
i started coming up with with with fake

263
00:08:45,519 --> 00:08:48,000
error codes and fake statute numbers

264
00:08:48,000 --> 00:08:49,920
like a title for hold which doesn't

265
00:08:49,920 --> 00:08:51,680
exist but what's really interesting is

266
00:08:51,680 --> 00:08:53,519
when the when the scammer got back to me

267
00:08:53,519 --> 00:08:55,440
he said oh yeah that's a tax uh there's

268
00:08:55,440 --> 00:08:57,279
a tax issue there so okay thank you for

269
00:08:57,279 --> 00:08:59,200
making up uh for telling me what my made

270
00:08:59,200 --> 00:09:01,920
up statue was all about um but at the

271
00:09:01,920 --> 00:09:03,040
end of the day

272
00:09:03,040 --> 00:09:04,320
obviously

273
00:09:04,320 --> 00:09:07,200
we didn't send any money to him and he

274
00:09:07,200 --> 00:09:09,440
kept communicating with us for two weeks

275
00:09:09,440 --> 00:09:11,440
he got no money out of this but really

276
00:09:11,440 --> 00:09:13,760
what that shows you is that

277
00:09:13,760 --> 00:09:15,920
he was willing to continue with this

278
00:09:15,920 --> 00:09:18,800
communication as long as he could have

279
00:09:18,800 --> 00:09:21,279
this sliver of hope that he was going to

280
00:09:21,279 --> 00:09:22,480
make something at the end of the day

281
00:09:22,480 --> 00:09:24,720
that's just how significantly uh

282
00:09:24,720 --> 00:09:25,920
financially motivated a lot of these

283
00:09:25,920 --> 00:09:27,519
guys are

284
00:09:27,519 --> 00:09:28,240
now

285
00:09:28,240 --> 00:09:30,560
doing that sort of manually is one thing

286
00:09:30,560 --> 00:09:32,160
but one of the things that my team my

287
00:09:32,160 --> 00:09:34,160
team has done is we've actually

288
00:09:34,160 --> 00:09:36,399
scaled this entire process up that gives

289
00:09:36,399 --> 00:09:39,120
us a really good representative view of

290
00:09:39,120 --> 00:09:42,160
the entire bec landscape so we we've

291
00:09:42,160 --> 00:09:44,720
built about 250 different personas that

292
00:09:44,720 --> 00:09:46,880
we use to engage with scammers we run

293
00:09:46,880 --> 00:09:49,120
more than 25 000 after defense

294
00:09:49,120 --> 00:09:50,720
engagements since the beginning of this

295
00:09:50,720 --> 00:09:53,440
year we've automated about 75 percent of

296
00:09:53,440 --> 00:09:55,440
the entire process so as you look at

297
00:09:55,440 --> 00:09:57,360
more and more of these you start seeing

298
00:09:57,360 --> 00:09:59,839
patterns of of language and behavior

299
00:09:59,839 --> 00:10:01,680
from these guys and we're able to sort

300
00:10:01,680 --> 00:10:04,399
of automate responses for a lot of these

301
00:10:04,399 --> 00:10:06,000
some engagements that we kick off today

302
00:10:06,000 --> 00:10:07,120
we actually

303
00:10:07,120 --> 00:10:08,800
approve them they get an initial

304
00:10:08,800 --> 00:10:10,880
response and we we never see them again

305
00:10:10,880 --> 00:10:13,200
because they go from beginning to end

306
00:10:13,200 --> 00:10:15,519
and it's a fully automated process

307
00:10:15,519 --> 00:10:17,040
we've been able to collect more than 10

308
00:10:17,040 --> 00:10:19,040
000 mule accounts that are used in bec

309
00:10:19,040 --> 00:10:22,160
attacks six more than 600 attacker ip

310
00:10:22,160 --> 00:10:24,320
addresses um and then we've also been

311
00:10:24,320 --> 00:10:26,399
able to cluster about a third of all of

312
00:10:26,399 --> 00:10:29,360
our bec engagements into about 50

313
00:10:29,360 --> 00:10:31,360
different primary threat groups that are

314
00:10:31,360 --> 00:10:33,040
out there

315
00:10:33,040 --> 00:10:34,880
and so once we do this at scale once we

316
00:10:34,880 --> 00:10:36,959
blow it up we're able to sort of better

317
00:10:36,959 --> 00:10:39,760
understand the get sort of a higher view

318
00:10:39,760 --> 00:10:44,320
of the uh of the bec landscape

319
00:10:44,320 --> 00:10:45,760
now the last thing i want to talk about

320
00:10:45,760 --> 00:10:47,440
here is go go over a case study to sort

321
00:10:47,440 --> 00:10:48,800
of run you guys through you know what

322
00:10:48,800 --> 00:10:50,720
this kind of looks like and what's

323
00:10:50,720 --> 00:10:52,560
really interesting about this case study

324
00:10:52,560 --> 00:10:54,959
is you know while we've talked about

325
00:10:54,959 --> 00:10:57,279
business email compromise bec what i'll

326
00:10:57,279 --> 00:10:58,880
run you through here is actually an

327
00:10:58,880 --> 00:11:01,760
engagement that that i conducted with a

328
00:11:01,760 --> 00:11:04,399
social engineering ransomware actor

329
00:11:04,399 --> 00:11:05,920
um and so

330
00:11:05,920 --> 00:11:08,240
this was an attack that happened about a

331
00:11:08,240 --> 00:11:09,279
year ago

332
00:11:09,279 --> 00:11:10,880
um actually i think it's exactly a year

333
00:11:10,880 --> 00:11:13,600
ago oh happy anniversary um

334
00:11:13,600 --> 00:11:17,120
so this this attack came in and it was

335
00:11:17,120 --> 00:11:19,519
interesting in the fact that instead of

336
00:11:19,519 --> 00:11:22,000
trying to deploy an actual payload or

337
00:11:22,000 --> 00:11:23,360
starting to get that initial network

338
00:11:23,360 --> 00:11:25,440
access that most ransomware that we see

339
00:11:25,440 --> 00:11:27,120
in most ransomware attacks what we saw

340
00:11:27,120 --> 00:11:28,560
with this is that we had an actor that

341
00:11:28,560 --> 00:11:30,399
was trying to socially engineer

342
00:11:30,399 --> 00:11:33,360
employees to get them to deploy

343
00:11:33,360 --> 00:11:35,680
ransomware on their network

344
00:11:35,680 --> 00:11:37,519
they said that you know if you launch

345
00:11:37,519 --> 00:11:40,079
and deploy demon wear ransomware on any

346
00:11:40,079 --> 00:11:42,800
main windows server i'll give you 40

347
00:11:42,800 --> 00:11:44,640
of the cut which is about a million a

348
00:11:44,640 --> 00:11:46,560
million dollars which if you do the math

349
00:11:46,560 --> 00:11:48,000
that's about a two and a half million

350
00:11:48,000 --> 00:11:51,040
dollar ransom that he would have um uh

351
00:11:51,040 --> 00:11:53,360
supposedly been asking for

352
00:11:53,360 --> 00:11:55,279
and so what was interesting about this

353
00:11:55,279 --> 00:11:57,600
because this is social engineering and

354
00:11:57,600 --> 00:12:00,639
because of the nature of this email

355
00:12:00,639 --> 00:12:02,240
it would have required

356
00:12:02,240 --> 00:12:04,320
a response from an employee to actually

357
00:12:04,320 --> 00:12:06,639
take them up on their offer

358
00:12:06,639 --> 00:12:08,079
so what did i do

359
00:12:08,079 --> 00:12:10,240
i took him up over his offer so the next

360
00:12:10,240 --> 00:12:12,959
day i created a telegram persona and

361
00:12:12,959 --> 00:12:15,360
actually sent a message um with the

362
00:12:15,360 --> 00:12:17,839
telegram uh uh account that he that he

363
00:12:17,839 --> 00:12:19,519
referenced in the initial email and

364
00:12:19,519 --> 00:12:21,839
within 30 minutes he got back to me uh

365
00:12:21,839 --> 00:12:23,360
with an initial response and so i you

366
00:12:23,360 --> 00:12:24,959
know you can see on the screen the

367
00:12:24,959 --> 00:12:27,200
initial uh message was you know saw your

368
00:12:27,200 --> 00:12:29,839
email what could i do to help and he

369
00:12:29,839 --> 00:12:30,639
said

370
00:12:30,639 --> 00:12:32,399
essentially the same thing that he said

371
00:12:32,399 --> 00:12:34,000
in that initial email

372
00:12:34,000 --> 00:12:36,399
and then what i see you know getting

373
00:12:36,399 --> 00:12:37,839
starting to

374
00:12:37,839 --> 00:12:39,120
get into the details a little bit

375
00:12:39,120 --> 00:12:40,800
started asking you know yeah sure i can

376
00:12:40,800 --> 00:12:42,639
help you what do i need how do i install

377
00:12:42,639 --> 00:12:44,079
it he starts talking about it's a

378
00:12:44,079 --> 00:12:45,839
software

379
00:12:45,839 --> 00:12:47,600
if the windows if the server is windows

380
00:12:47,600 --> 00:12:49,519
i'll give you the software so great so

381
00:12:49,519 --> 00:12:51,680
this initial covert operation sort of

382
00:12:51,680 --> 00:12:54,160
lasted five days but i want to show you

383
00:12:54,160 --> 00:12:55,839
a bit of what the

384
00:12:55,839 --> 00:12:59,040
information we were able to obtain from

385
00:12:59,040 --> 00:13:01,680
this guy solely based on this initial

386
00:13:01,680 --> 00:13:03,760
engagement because again this is why

387
00:13:03,760 --> 00:13:06,720
active defense is really helpful because

388
00:13:06,720 --> 00:13:08,240
if we weren't for this we would be

389
00:13:08,240 --> 00:13:10,880
totally relying on that initial email

390
00:13:10,880 --> 00:13:12,639
to essentially give us all the

391
00:13:12,639 --> 00:13:14,079
information we would have about this

392
00:13:14,079 --> 00:13:16,240
attack and the attacker

393
00:13:16,240 --> 00:13:17,440
so the first thing that we were able to

394
00:13:17,440 --> 00:13:19,360
get is an actual sample of the

395
00:13:19,360 --> 00:13:21,279
ransomware that they wanted that this

396
00:13:21,279 --> 00:13:23,839
guy wanted to use so he sent it to me

397
00:13:23,839 --> 00:13:25,440
actually using two ways this was

398
00:13:25,440 --> 00:13:27,200
actually through through mega but he

399
00:13:27,200 --> 00:13:28,880
also tried to send it to me using we

400
00:13:28,880 --> 00:13:31,440
transfer as well and it was through an

401
00:13:31,440 --> 00:13:33,920
executable file we did an analysis of it

402
00:13:33,920 --> 00:13:35,600
and lo and behold it was in fact demon

403
00:13:35,600 --> 00:13:38,399
wear ransomware

404
00:13:38,639 --> 00:13:40,240
what was also really interesting and i

405
00:13:40,240 --> 00:13:41,519
think if you talk to anyone who does

406
00:13:41,519 --> 00:13:43,279
ransomware negotiations this is

407
00:13:43,279 --> 00:13:45,279
something that you'll actually see a lot

408
00:13:45,279 --> 00:13:48,000
of is that there's a lot of flexibility

409
00:13:48,000 --> 00:13:50,399
into what they are willing to accept

410
00:13:50,399 --> 00:13:52,560
when it comes to ransomware payments so

411
00:13:52,560 --> 00:13:55,040
as we said in the beginning

412
00:13:55,040 --> 00:13:57,519
you know based on the inferences we

413
00:13:57,519 --> 00:13:59,120
could make from that initial email the

414
00:13:59,120 --> 00:14:00,720
original ransom that he would have been

415
00:14:00,720 --> 00:14:01,839
asking for was about two and a half

416
00:14:01,839 --> 00:14:04,560
million dollars um at some point in our

417
00:14:04,560 --> 00:14:06,720
conversation he started asking me about

418
00:14:06,720 --> 00:14:08,959
the company i supposedly worked for

419
00:14:08,959 --> 00:14:11,120
um i said it was a medium-sized company

420
00:14:11,120 --> 00:14:12,800
about about you know 50 million dollars

421
00:14:12,800 --> 00:14:14,959
of annual revenue he said well maybe in

422
00:14:14,959 --> 00:14:17,839
that case we can ask him for 250 000

423
00:14:17,839 --> 00:14:19,279
i was like whoa hold on a second you

424
00:14:19,279 --> 00:14:20,720
just said you were going to pay me you

425
00:14:20,720 --> 00:14:22,160
know you were going to pay me a million

426
00:14:22,160 --> 00:14:24,000
dollars to do this for you what's what

427
00:14:24,000 --> 00:14:26,079
what gives with that and then he said

428
00:14:26,079 --> 00:14:27,360
well you know we can if you want me to

429
00:14:27,360 --> 00:14:28,959
charge him a million charge of a million

430
00:14:28,959 --> 00:14:30,160
but you know we could also charge them

431
00:14:30,160 --> 00:14:33,040
120 000. like okay but what's really

432
00:14:33,040 --> 00:14:35,120
interesting about this is that

433
00:14:35,120 --> 00:14:36,000
this

434
00:14:36,000 --> 00:14:38,560
because this is so financially motivated

435
00:14:38,560 --> 00:14:40,880
you know regardless of whether it's 200

436
00:14:40,880 --> 00:14:43,199
250 000. two and a half million dollars

437
00:14:43,199 --> 00:14:45,279
120 000

438
00:14:45,279 --> 00:14:47,680
whatever amount that is is life-changing

439
00:14:47,680 --> 00:14:50,079
for this guy right so that's all that

440
00:14:50,079 --> 00:14:52,320
really matters here you know this is why

441
00:14:52,320 --> 00:14:54,320
gift card bec attacks are still a thing

442
00:14:54,320 --> 00:14:55,920
today even though they're only making a

443
00:14:55,920 --> 00:14:57,519
thousand dollars fifteen hundred dollars

444
00:14:57,519 --> 00:14:59,760
a pop that's still a lot of money when

445
00:14:59,760 --> 00:15:01,600
you're making five hundred dollars a

446
00:15:01,600 --> 00:15:03,920
month right

447
00:15:03,920 --> 00:15:05,360
so it's also interesting we are able to

448
00:15:05,360 --> 00:15:07,519
identify you know where did this guy get

449
00:15:07,519 --> 00:15:10,000
their targets information so

450
00:15:10,000 --> 00:15:12,480
you know not uh not uncommon here he

451
00:15:12,480 --> 00:15:13,839
said that he got you know then all the

452
00:15:13,839 --> 00:15:15,519
information from linkedin and what's

453
00:15:15,519 --> 00:15:16,800
really interesting is when we've done a

454
00:15:16,800 --> 00:15:19,600
lot of the research into bec attackers

455
00:15:19,600 --> 00:15:21,120
we're able to sort of understand where

456
00:15:21,120 --> 00:15:22,720
they get target information from it's

457
00:15:22,720 --> 00:15:24,720
really interesting it's the same

458
00:15:24,720 --> 00:15:26,800
same tools free like uh actual

459
00:15:26,800 --> 00:15:28,399
legitimate commercial tools that sales

460
00:15:28,399 --> 00:15:30,240
and marketing teams use to identify

461
00:15:30,240 --> 00:15:32,959
sales prospects or are the exact same

462
00:15:32,959 --> 00:15:34,800
tools that a lot of these guys are using

463
00:15:34,800 --> 00:15:37,600
to identify their targets um what's

464
00:15:37,600 --> 00:15:39,440
really they'll sign up for a free trial

465
00:15:39,440 --> 00:15:41,120
they'll sign up for uh sign up for

466
00:15:41,120 --> 00:15:43,199
actual actual subscription using a

467
00:15:43,199 --> 00:15:45,519
compromise credit card and they can put

468
00:15:45,519 --> 00:15:47,519
in a number of different parameters for

469
00:15:47,519 --> 00:15:49,759
who they actually want to target and a

470
00:15:49,759 --> 00:15:51,680
lot of these services just pop out a

471
00:15:51,680 --> 00:15:54,480
very nice organized csv file containing

472
00:15:54,480 --> 00:15:56,480
all of the initial uh lead contact

473
00:15:56,480 --> 00:15:58,399
information that they need to then carry

474
00:15:58,399 --> 00:16:00,720
on their attacks

475
00:16:00,720 --> 00:16:02,079
uh where did the code from at some point

476
00:16:02,079 --> 00:16:03,120
i was like you know where did this where

477
00:16:03,120 --> 00:16:04,639
did this come from out of curiosity did

478
00:16:04,639 --> 00:16:06,240
you create the file are you just using

479
00:16:06,240 --> 00:16:08,880
it so he told me uh that he programmed

480
00:16:08,880 --> 00:16:11,440
the software using python language uh

481
00:16:11,440 --> 00:16:13,680
and i said was it was it hard to create

482
00:16:13,680 --> 00:16:15,680
he said yes of course of course of

483
00:16:15,680 --> 00:16:17,759
course of course it was very hard but of

484
00:16:17,759 --> 00:16:19,680
course if we did a little research into

485
00:16:19,680 --> 00:16:20,560
this

486
00:16:20,560 --> 00:16:23,279
this demon wear ransomware actually is

487
00:16:23,279 --> 00:16:25,839
open source it's available on github uh

488
00:16:25,839 --> 00:16:28,320
it's one of those you know uh security

489
00:16:28,320 --> 00:16:30,240
awareness ransomware strains that are

490
00:16:30,240 --> 00:16:32,959
out there um that he essentially

491
00:16:32,959 --> 00:16:34,880
downloaded for free and was using and

492
00:16:34,880 --> 00:16:37,040
was using it

493
00:16:37,040 --> 00:16:38,639
and then the final thing before we get

494
00:16:38,639 --> 00:16:40,399
to the end of this is you know when it

495
00:16:40,399 --> 00:16:42,079
comes to attribution

496
00:16:42,079 --> 00:16:44,639
sometimes you just need to ask

497
00:16:44,639 --> 00:16:46,800
right so at some point in this i was

498
00:16:46,800 --> 00:16:48,480
like you know playing along with them

499
00:16:48,480 --> 00:16:49,680
like you know how do i know you're not

500
00:16:49,680 --> 00:16:51,199
gonna screw me because i'm a little

501
00:16:51,199 --> 00:16:53,680
concerned about this because uh you know

502
00:16:53,680 --> 00:16:55,279
this is something i'm a little scared

503
00:16:55,279 --> 00:16:56,959
about and he was like well i'll give you

504
00:16:56,959 --> 00:16:59,519
some information you know i own this

505
00:16:59,519 --> 00:17:02,480
nigerian social networking uh platform

506
00:17:02,480 --> 00:17:05,039
here's my linkedin profile which

507
00:17:05,039 --> 00:17:07,679
actually was his linkedin profile

508
00:17:07,679 --> 00:17:09,919
uh he said he was gonna be the next mark

509
00:17:09,919 --> 00:17:12,000
zuckerberg uh and then of course i was

510
00:17:12,000 --> 00:17:14,079
like so just to be clear are you in

511
00:17:14,079 --> 00:17:15,760
nigeria and he was like yeah i'm in

512
00:17:15,760 --> 00:17:20,720
nigeria so that was pretty easy right um

513
00:17:20,720 --> 00:17:21,839
and so

514
00:17:21,839 --> 00:17:24,000
with this you know this was the initial

515
00:17:24,000 --> 00:17:27,039
engagement last five days i did what

516
00:17:27,039 --> 00:17:29,760
a good vendor does and we wrote a blog

517
00:17:29,760 --> 00:17:30,720
post

518
00:17:30,720 --> 00:17:33,280
and so we wrote a blog post about it and

519
00:17:33,280 --> 00:17:36,880
then uh krebs also picked up on it and

520
00:17:36,880 --> 00:17:40,720
wrote an article uh in uh on his blog

521
00:17:40,720 --> 00:17:42,880
and then a couple days later

522
00:17:42,880 --> 00:17:44,880
i got a message on telegram

523
00:17:44,880 --> 00:17:46,880
and it was this guy like dude i just

524
00:17:46,880 --> 00:17:49,039
read this what is this all about and i

525
00:17:49,039 --> 00:17:50,559
was like oh

526
00:17:50,559 --> 00:17:53,039
i didn't know that you read these things

527
00:17:53,039 --> 00:17:53,840
so

528
00:17:53,840 --> 00:17:56,000
so clearly they're paying attention to

529
00:17:56,000 --> 00:17:58,400
what's actually going on but this gave

530
00:17:58,400 --> 00:18:01,600
us a really good opportunity to sort of

531
00:18:01,600 --> 00:18:04,480
pivot the conversation and engage this

532
00:18:04,480 --> 00:18:06,080
guy even further and so that's what we

533
00:18:06,080 --> 00:18:09,200
did so this engagement actually pivoted

534
00:18:09,200 --> 00:18:11,679
from a covert uh a covert engagement to

535
00:18:11,679 --> 00:18:13,840
an overt engagement where he obviously

536
00:18:13,840 --> 00:18:16,720
knew who he was talking to at the time

537
00:18:16,720 --> 00:18:19,760
and i got on a a skype call with this

538
00:18:19,760 --> 00:18:22,080
guy and started asking him a bunch of

539
00:18:22,080 --> 00:18:23,440
other questions and one of the things

540
00:18:23,440 --> 00:18:24,640
that i found

541
00:18:24,640 --> 00:18:26,640
with bec actors and a lot of scammers

542
00:18:26,640 --> 00:18:28,799
from nigeria is they like to talk

543
00:18:28,799 --> 00:18:30,720
i've done a couple dozen of these

544
00:18:30,720 --> 00:18:33,919
interviews with these actors in nigeria

545
00:18:33,919 --> 00:18:34,960
and

546
00:18:34,960 --> 00:18:36,320
and they will

547
00:18:36,320 --> 00:18:39,760
relatively easily tell you a lot about

548
00:18:39,760 --> 00:18:41,679
why and how they do what they do and so

549
00:18:41,679 --> 00:18:43,520
i want to go over a couple of the sort

550
00:18:43,520 --> 00:18:45,120
of uh you know

551
00:18:45,120 --> 00:18:47,200
clips from that interview to provide a

552
00:18:47,200 --> 00:18:49,039
little bit more context to help you

553
00:18:49,039 --> 00:18:50,640
understand you know a little bit more

554
00:18:50,640 --> 00:18:54,400
about the motivations of these actors

555
00:18:54,400 --> 00:18:56,640
and so the the first clip i want to show

556
00:18:56,640 --> 00:18:59,120
you is you know goes hits to the core of

557
00:18:59,120 --> 00:19:01,120
the motivation of why these actors do

558
00:19:01,120 --> 00:19:03,760
what they do and essentially i asked him

559
00:19:03,760 --> 00:19:05,600
you know why why do you do this like

560
00:19:05,600 --> 00:19:08,000
what what drives you to run these types

561
00:19:08,000 --> 00:19:10,640
of scams and so this is what he said

562
00:19:10,640 --> 00:19:13,200
i'm a normal guy in these streets of

563
00:19:13,200 --> 00:19:14,799
africa you know

564
00:19:14,799 --> 00:19:16,640
trying to survive

565
00:19:16,640 --> 00:19:18,559
you understand

566
00:19:18,559 --> 00:19:21,120
trying to survive and

567
00:19:21,120 --> 00:19:22,840
it's not easy you

568
00:19:22,840 --> 00:19:24,559
understand

569
00:19:24,559 --> 00:19:26,480
it's not easy in

570
00:19:26,480 --> 00:19:28,640
streets of africa

571
00:19:28,640 --> 00:19:32,559
in nigeria it's very very hard

572
00:19:32,559 --> 00:19:33,440
so

573
00:19:33,440 --> 00:19:35,760
let's just say you know there's a thing

574
00:19:35,760 --> 00:19:38,799
going on in nigeria

575
00:19:38,799 --> 00:19:40,960
most especially and

576
00:19:40,960 --> 00:19:43,280
all the young

577
00:19:43,280 --> 00:19:46,880
ones coming up they all want to do fraud

578
00:19:46,880 --> 00:19:48,799
you know

579
00:19:48,799 --> 00:19:51,360
you understand but in some people the

580
00:19:51,360 --> 00:19:53,200
cases is

581
00:19:53,200 --> 00:19:56,480
to feed your family you understand

582
00:19:56,480 --> 00:20:00,080
see their family and provide leads and

583
00:20:00,080 --> 00:20:01,840
also try to

584
00:20:01,840 --> 00:20:04,400
just survive that's just it

585
00:20:04,400 --> 00:20:07,600
trying to survive so this is something

586
00:20:07,600 --> 00:20:08,720
so that the

587
00:20:08,720 --> 00:20:11,039
you know the synopsis of this is that

588
00:20:11,039 --> 00:20:12,880
they're doing this as a job because they

589
00:20:12,880 --> 00:20:15,440
can't make money doing other things this

590
00:20:15,440 --> 00:20:17,679
is a very common response i've gotten to

591
00:20:17,679 --> 00:20:19,120
this question over and over and over

592
00:20:19,120 --> 00:20:20,720
again and anyone who who sort of has

593
00:20:20,720 --> 00:20:22,799
researched west african fraud and

594
00:20:22,799 --> 00:20:25,120
scamming this is something that is not a

595
00:20:25,120 --> 00:20:27,760
surprise to anyone um you know from a

596
00:20:27,760 --> 00:20:29,600
criminal behavior perspective this fits

597
00:20:29,600 --> 00:20:32,080
very nicely into understanding you know

598
00:20:32,080 --> 00:20:34,480
what drives these guys you know if you

599
00:20:34,480 --> 00:20:36,799
think about it the average salary if

600
00:20:36,799 --> 00:20:38,559
someone can get employed in nigeria is

601
00:20:38,559 --> 00:20:40,960
about 500 a month um but the

602
00:20:40,960 --> 00:20:42,640
unemployment rate for

603
00:20:42,640 --> 00:20:45,760
young men in nigeria regardless of their

604
00:20:45,760 --> 00:20:49,200
education uh is is is huge upwards of

605
00:20:49,200 --> 00:20:52,240
fifty percent and so scamming and social

606
00:20:52,240 --> 00:20:54,000
engineering has been sort of ingrained

607
00:20:54,000 --> 00:20:56,640
in nigerian culture specifically as a

608
00:20:56,640 --> 00:20:59,120
quasi-legitimate way uh to make money

609
00:20:59,120 --> 00:21:02,159
for literally 30 years at this point um

610
00:21:02,159 --> 00:21:05,520
and so this is not uh very uh very

611
00:21:05,520 --> 00:21:07,600
uncommon and so

612
00:21:07,600 --> 00:21:09,919
one of the other things i asked him

613
00:21:09,919 --> 00:21:12,240
uh was i was curious about sort of

614
00:21:12,240 --> 00:21:13,520
understanding you know

615
00:21:13,520 --> 00:21:15,039
what would sort of

616
00:21:15,039 --> 00:21:17,120
prevent these types of attacks like if

617
00:21:17,120 --> 00:21:19,280
you were on the other side what would

618
00:21:19,280 --> 00:21:21,919
have made it harder for you uh to

619
00:21:21,919 --> 00:21:24,240
accomplish your goals

620
00:21:24,240 --> 00:21:25,840
for people that i hope

621
00:21:25,840 --> 00:21:29,200
to be helpful to people is to

622
00:21:29,200 --> 00:21:32,320
invest in cyber security

623
00:21:32,320 --> 00:21:35,360
you understand um if you watch movies

624
00:21:35,360 --> 00:21:38,320
like the laundromats you know about them

625
00:21:38,320 --> 00:21:40,240
so movie

626
00:21:40,240 --> 00:21:42,720
you know it was a company that was into

627
00:21:42,720 --> 00:21:45,120
money laundering and defending its stops

628
00:21:45,120 --> 00:21:47,840
you know stand they laundered money for

629
00:21:47,840 --> 00:21:50,559
presidents and a lot of people but at

630
00:21:50,559 --> 00:21:51,919
the end of the day

631
00:21:51,919 --> 00:21:54,480
their secrets in the company was posted

632
00:21:54,480 --> 00:21:55,280
out

633
00:21:55,280 --> 00:21:59,200
due to weak cyber security

634
00:21:59,200 --> 00:22:01,120
no a lot of files of their money

635
00:22:01,120 --> 00:22:03,360
laundering activities were posted online

636
00:22:03,360 --> 00:22:05,600
linking to presidents

637
00:22:05,600 --> 00:22:06,720
um

638
00:22:06,720 --> 00:22:08,880
prime ministers and a lot of people i

639
00:22:08,880 --> 00:22:10,880
think the story is online try to watch

640
00:22:10,880 --> 00:22:13,120
the movie laundromats

641
00:22:13,120 --> 00:22:15,840
so what i'm trying to bring out is that

642
00:22:15,840 --> 00:22:18,959
my advice to people

643
00:22:19,120 --> 00:22:20,240
is to

644
00:22:20,240 --> 00:22:21,440
best

645
00:22:21,440 --> 00:22:23,679
cyber security and like i said within

646
00:22:23,679 --> 00:22:26,880
the next 5-10 years fising

647
00:22:26,880 --> 00:22:28,799
will be 18 of the past

648
00:22:28,799 --> 00:22:30,640
so it's that it's that simple

649
00:22:30,640 --> 00:22:32,400
uh you know just invest in cyber

650
00:22:32,400 --> 00:22:34,320
security which i think is something that

651
00:22:34,320 --> 00:22:35,440
you know

652
00:22:35,440 --> 00:22:37,200
my company says all the time right

653
00:22:37,200 --> 00:22:39,200
invest in cyber security has anyone here

654
00:22:39,200 --> 00:22:41,760
seen the laundromat

655
00:22:41,760 --> 00:22:43,760
yeah so i actually have not gone and

656
00:22:43,760 --> 00:22:45,520
watched that movie yet but i really need

657
00:22:45,520 --> 00:22:47,919
to um but it's a great recommendation

658
00:22:47,919 --> 00:22:50,559
right so um so you know it was he says

659
00:22:50,559 --> 00:22:52,080
there at the end you know just in five

660
00:22:52,080 --> 00:22:53,600
to ten years fishing will be a thing of

661
00:22:53,600 --> 00:22:55,919
the past and i asked him i was like

662
00:22:55,919 --> 00:22:57,679
you know if that does happen let's say

663
00:22:57,679 --> 00:22:59,120
let's say everyone invests in cyber

664
00:22:59,120 --> 00:23:00,159
security

665
00:23:00,159 --> 00:23:02,320
what happens there and he says i don't

666
00:23:02,320 --> 00:23:03,679
know maybe i'll just go into farming or

667
00:23:03,679 --> 00:23:06,640
something i was like oh okay interesting

668
00:23:06,640 --> 00:23:09,840
so the last thing i'll i'll show here is

669
00:23:09,840 --> 00:23:11,919
you know as we were talking about people

670
00:23:11,919 --> 00:23:14,799
investing in cyber security um he

671
00:23:14,799 --> 00:23:17,039
mentioned something very strange which

672
00:23:17,039 --> 00:23:19,360
uh which which he sort of brought up

673
00:23:19,360 --> 00:23:20,880
yes my

674
00:23:20,880 --> 00:23:25,600
advice you know to people out there

675
00:23:25,679 --> 00:23:28,799
is to invest cyber security

676
00:23:28,799 --> 00:23:30,480
and

677
00:23:30,480 --> 00:23:31,520
people

678
00:23:31,520 --> 00:23:34,400
out there to invest in companies like

679
00:23:34,400 --> 00:23:36,960
abnormal security

680
00:23:36,960 --> 00:23:38,240
like i said

681
00:23:38,240 --> 00:23:40,400
cyber security

682
00:23:40,400 --> 00:23:41,760
yeah so i don't know if he was trying to

683
00:23:41,760 --> 00:23:44,000
get like a you know a spokesman job or

684
00:23:44,000 --> 00:23:46,400
something like that um but he actually

685
00:23:46,400 --> 00:23:48,080
said you know people should invest in

686
00:23:48,080 --> 00:23:49,440
abnormal security a couple times like

687
00:23:49,440 --> 00:23:52,960
this is very strange um so so anyway you

688
00:23:52,960 --> 00:23:55,120
know i hope this gives you a general you

689
00:23:55,120 --> 00:23:56,320
know understanding a really quick

690
00:23:56,320 --> 00:23:58,400
understanding of how techniques like

691
00:23:58,400 --> 00:24:00,720
this can be used to better understand

692
00:24:00,720 --> 00:24:02,240
the threats that we're seeing that are

693
00:24:02,240 --> 00:24:04,720
getting worse every single year um you

694
00:24:04,720 --> 00:24:07,600
know again it's something that uh that

695
00:24:07,600 --> 00:24:10,320
that's been really it's really in enjoy

696
00:24:10,320 --> 00:24:12,400
uh uh it really gives you a lot of

697
00:24:12,400 --> 00:24:14,400
enjoyment to do things like this it

698
00:24:14,400 --> 00:24:15,760
helps you better understand the problems

699
00:24:15,760 --> 00:24:17,600
and the people behind these uh these

700
00:24:17,600 --> 00:24:19,840
attacks so with that that's all i've got

701
00:24:19,840 --> 00:24:21,039
i

702
00:24:21,039 --> 00:24:23,200
may have time for one question but other

703
00:24:23,200 --> 00:24:25,440
than that i hope everyone has a great

704
00:24:25,440 --> 00:24:28,700
rest of the conference

705
00:24:28,700 --> 00:24:35,359
[Applause]