1 00:00:00,000 --> 00:00:03,520 Up next, we have a veteran speaker at Recon... 2 00:00:03,980 --> 00:00:09,640 He's been a veteran speaker in the Recon villages over the years and he's going to come and speak with us over here as well. 3 00:00:10,080 --> 00:00:15,080 He is a hacker, a freak, a social engineer, a podcast host as well. 4 00:00:15,140 --> 00:00:19,800 And as we can see, he definitely is someone with whom we do not want to mess with. 5 00:00:19,960 --> 00:00:28,340 He is a martial arts specialist and a hacker for 22 years and he's been doing some stalking and anti-stalking research as well for the last 6 years. 6 00:00:28,340 --> 00:00:30,540 Please welcome Master Shen. 7 00:00:37,500 --> 00:00:38,880 Hello everybody. 8 00:00:39,380 --> 00:00:41,520 First I want to say thank you to the Recon village. 9 00:00:41,520 --> 00:00:46,560 You guys have been entertaining me for the last quite a few years. 10 00:00:46,820 --> 00:00:53,980 I've been doing this for stalking and anti-stalking, URL shortening for quite some time now. 11 00:00:54,360 --> 00:01:02,400 No matter how experienced I get with this stuff, it's always really cool to see everybody fill the room and want to talk afterwards. 12 00:01:02,400 --> 00:01:03,420 It's really awesome. 13 00:01:03,420 --> 00:01:08,460 So today we're talking about being the disinformation campaign. 14 00:01:09,100 --> 00:01:16,020 And if you're wondering about the whole get-up, it's because I had the Afro because I figured what I'd be wearing you wouldn't see me. 15 00:01:16,360 --> 00:01:18,020 So the Afro's there. 16 00:01:18,080 --> 00:01:19,780 Just so you guys can see me. 17 00:01:20,700 --> 00:01:21,380 Okay. 18 00:01:21,520 --> 00:01:23,620 So I'm the disinformation campaign. 19 00:01:23,620 --> 00:01:25,560 My name is Master Shen and I am Shenbox. 20 00:01:25,560 --> 00:01:30,700 That's S-H-E-N-B-0-X on all social media. 21 00:01:32,160 --> 00:01:32,880 Okay. 22 00:01:33,160 --> 00:01:34,700 So a little bit more about who I am. 23 00:01:34,700 --> 00:01:36,620 I know there's this awesome introduction. 24 00:01:36,620 --> 00:01:38,680 I want to just give a little bit more context to that. 25 00:01:38,800 --> 00:01:39,940 I have a B.A. 26 00:01:39,940 --> 00:01:44,360 in psychology from the University of Nevada, Las Vegas, here in Las Vegas. 27 00:01:44,660 --> 00:01:49,360 I've been going to DEF CON since DEF CON 12 and I've been a hacker for just as long as I've been a martial artist. 28 00:01:49,360 --> 00:01:52,960 I started both interests when I was about 10 years old. 29 00:01:53,000 --> 00:01:54,800 There's your hint to my age. 30 00:01:54,880 --> 00:01:56,020 I'm getting older now, right? 31 00:01:56,020 --> 00:01:57,420 So it's been about 19 years. 32 00:01:57,420 --> 00:02:06,940 And that brings me to the middle section, which is the Linux penguin with the Shaolin monk on the centerpiece there. 33 00:02:06,980 --> 00:02:08,020 So that's who I am. 34 00:02:08,240 --> 00:02:13,840 But I want to know who you guys are and this is the only part of information gathering that I'll be doing today. 35 00:02:14,480 --> 00:02:15,500 I promise. 36 00:02:16,740 --> 00:02:18,560 So first time DEF CONers? 37 00:02:19,680 --> 00:02:21,460 Wow, that's actually quite a bit. 38 00:02:21,460 --> 00:02:21,740 Cool. 39 00:02:21,740 --> 00:02:22,640 Well, welcome. 40 00:02:22,720 --> 00:02:23,740 I'd love to see you guys here. 41 00:02:23,740 --> 00:02:24,440 This is awesome. 42 00:02:24,440 --> 00:02:29,100 Do we have any victims of cyber-stalking or anti-stalking? 43 00:02:29,300 --> 00:02:30,680 Okay, there we go. 44 00:02:30,740 --> 00:02:35,040 Yes, absolutely, because of course you guys know this is what I've been talking about recently. 45 00:02:35,420 --> 00:02:37,200 Do we have any OSINT noobs? 46 00:02:37,200 --> 00:02:41,820 Like this is your first time in Recon Village, the first time even getting introduced to this type of work. 47 00:02:41,980 --> 00:02:43,100 Okay, a couple out there. 48 00:02:43,260 --> 00:02:45,020 Do we have any OSINT pros? 49 00:02:45,020 --> 00:02:46,980 Like people who just do this all the time. 50 00:02:47,460 --> 00:02:48,700 I figured more people would be handed that. 51 00:02:48,700 --> 00:02:50,440 Okay, more people had their hands up. 52 00:02:51,520 --> 00:02:56,500 Alright, now here's my favorite part of the presentation. 53 00:02:57,320 --> 00:02:58,180 Disclaimers here, okay? 54 00:02:58,180 --> 00:03:01,740 I want to put this out there before I start talking about the shit that I talk about, okay? 55 00:03:01,780 --> 00:03:04,800 So, first one is, I anal, I anus. 56 00:03:06,860 --> 00:03:08,220 I am not a lawyer. 57 00:03:09,040 --> 00:03:10,980 I am not a stalker, okay? 58 00:03:10,980 --> 00:03:12,300 I anal, I anus. 59 00:03:14,340 --> 00:03:17,380 And I can't believe I have to put this up here, but I have to put this up here. 60 00:03:17,520 --> 00:03:19,740 I am not your moral compass, okay? 61 00:03:19,740 --> 00:03:23,120 You guys are not at an information security conference. 62 00:03:23,220 --> 00:03:24,880 You're at a hacker conference. 63 00:03:24,880 --> 00:03:29,760 So we're going to be talking about shit that is sometimes professional, maybe not all the time. 64 00:03:29,860 --> 00:03:31,460 I am not your moral compass. 65 00:03:32,500 --> 00:03:33,620 Use your judgment. 66 00:03:33,620 --> 00:03:35,300 And mileage may vary, okay? 67 00:03:35,420 --> 00:03:38,440 So what I mean by that is, I'm going to be talking about certain things. 68 00:03:38,440 --> 00:03:40,580 It may work for you, it may not work for you. 69 00:03:40,580 --> 00:03:41,380 Try it out. 70 00:03:41,380 --> 00:03:42,220 Be a hacker. 71 00:03:44,260 --> 00:03:46,220 Alright, so why this talk? 72 00:03:46,220 --> 00:03:50,980 Well, open source intelligence, it gives the advantage to the seeker. 73 00:03:50,980 --> 00:04:00,680 I know that a lot of talks that we've been having today is about bug bounty and recon on AppSec or the network or more technical things. 74 00:04:00,680 --> 00:04:05,740 But another thing about Recon Village is that there's OSINT on, of course, people, human targets, etc., etc. 75 00:04:06,180 --> 00:04:12,100 So OSINT gives the advantage to the seeker, the person who's looking for, of course, their target, okay? 76 00:04:12,100 --> 00:04:18,660 And for me, in my eyes, disinformation gives... it's like an equalizer to the person who's trying to hide. 77 00:04:18,920 --> 00:04:22,660 You know, again, I asked how many people were victims of cyberstalking. 78 00:04:22,980 --> 00:04:24,980 Not everybody wants to be found, okay? 79 00:04:24,980 --> 00:04:33,120 So I'm hoping that this kind of gives... we drop a little caltrops on the floor so that people get their foot stuck in these red herrings that we have. 80 00:04:35,920 --> 00:04:38,180 And the funny thing about... well, not the funny thing. 81 00:04:38,180 --> 00:04:39,560 I don't think any of that part's funny. 82 00:04:39,560 --> 00:04:47,220 But cyberstalking victims, they have this choice of either I participate in social media or I don't. 83 00:04:47,220 --> 00:04:48,880 And it's like a binary choice. 84 00:04:48,880 --> 00:04:50,060 It's like one or the other. 85 00:04:50,300 --> 00:04:58,940 And so the reason I want to do this talk is because you can be online and maybe it's not going to be so horrible with whatever you're dealing with. 86 00:04:58,940 --> 00:05:00,220 At least that's what I hope. 87 00:05:00,540 --> 00:05:05,720 And the last part here is I think as we grew up... remember, I've been here since like DEF CON 12. 88 00:05:05,720 --> 00:05:16,000 But as we grew up, I think even hackers, even a lot of hackers and OSINT noobs alike, people who are here for the first time, we forgot that it's okay. 89 00:05:16,120 --> 00:05:17,840 It's okay to lie on the Internet. 90 00:05:18,000 --> 00:05:21,420 But for some reason, we've turned the Internet into this source of truth. 91 00:05:21,500 --> 00:05:24,120 And I don't think it necessarily needs to be that way. 92 00:05:24,320 --> 00:05:26,820 I hope I have some agreement here. 93 00:05:28,440 --> 00:05:32,040 All right, big thing here, misinformation versus disinformation. 94 00:05:32,040 --> 00:05:35,700 I didn't even know that there was a misinformation village here this year. 95 00:05:35,700 --> 00:05:39,700 But that's okay, because I love the recon village anyway, so I'm here. 96 00:05:39,780 --> 00:05:44,540 Now, misinformation is the unintentional spreading of false information. 97 00:05:44,800 --> 00:05:48,880 Unintentional, accidental, made-up statistics just off the top of your head. 98 00:05:49,100 --> 00:05:51,840 60% of people think whatever, right? 99 00:05:52,720 --> 00:05:54,840 Disinformation, however, is intentional. 100 00:05:54,840 --> 00:05:55,780 It's organized. 101 00:05:55,840 --> 00:05:59,920 It's absolutely the reason you're doing things, right? 102 00:06:00,380 --> 00:06:02,180 So I just wanted to clear that up. 103 00:06:02,180 --> 00:06:02,980 There's a difference here. 104 00:06:02,980 --> 00:06:08,340 So if anybody out here is writing a news article, please use the proper terminology. 105 00:06:08,340 --> 00:06:09,300 Can we say that? 106 00:06:11,220 --> 00:06:13,600 All right, so how this whole thing started. 107 00:06:15,600 --> 00:06:23,760 I was hanging out at a cafe among friends, and the conversation came up that nobody can guess my middle name. 108 00:06:23,760 --> 00:06:25,380 I said, what's my middle name? 109 00:06:25,600 --> 00:06:27,040 And so they kept guessing, they kept guessing. 110 00:06:27,040 --> 00:06:28,400 I put a dollar on the table. 111 00:06:28,400 --> 00:06:30,100 They kept guessing, they kept guessing. 112 00:06:30,100 --> 00:06:33,760 I have that dollar still, or at least I had that dollar by the end of the night. 113 00:06:33,760 --> 00:06:38,680 So they didn't actually guess my middle name, and that's because maybe I don't have one. 114 00:06:40,720 --> 00:06:52,920 But it taught me the first thing that really kind of started me thinking on this path, which is that disinformation can start with just how you present the information or the subject matter. 115 00:06:52,920 --> 00:06:58,320 So it doesn't necessarily need to be very explicit or very open or very direct to the point. 116 00:06:58,320 --> 00:07:01,700 You just suggest things, and people start to fill in their own gaps. 117 00:07:01,700 --> 00:07:03,920 They start to think, okay, well, right? 118 00:07:04,960 --> 00:07:06,520 Brings me to my second point. 119 00:07:06,860 --> 00:07:14,300 When I was 17, I went for my driver's license. 120 00:07:14,300 --> 00:07:16,460 I had already passed the driver's test. 121 00:07:16,460 --> 00:07:18,100 I was ready to take my picture. 122 00:07:18,100 --> 00:07:19,780 Didn't look nearly as cool now. 123 00:07:21,920 --> 00:07:31,840 So I'm ready to sign the paperwork, and the person at the DMV counter says, I'm sorry, we can't give you your license because you have a record. 124 00:07:32,220 --> 00:07:33,980 You have a record in New York. 125 00:07:34,140 --> 00:07:37,360 Well, when I was 17, I have never been to New York. 126 00:07:37,360 --> 00:07:38,980 So I was like, wait, what? 127 00:07:39,620 --> 00:07:40,980 So she's like, well, what's your first name? 128 00:07:40,980 --> 00:07:41,640 Master. 129 00:07:41,680 --> 00:07:42,560 What's your last name? 130 00:07:42,560 --> 00:07:43,180 Chen. 131 00:07:44,240 --> 00:07:45,920 What's your social security number? 132 00:07:47,000 --> 00:07:48,380 One, two, three, four, five. 133 00:07:49,000 --> 00:07:50,540 Oh, that's not you. 134 00:07:50,920 --> 00:07:52,080 Oh, it's not. 135 00:07:52,080 --> 00:07:53,920 Okay, 17-year-old with a record. 136 00:07:54,060 --> 00:07:54,960 I'm a nerd. 137 00:07:55,920 --> 00:07:58,220 I'm very, very, very, yeah. 138 00:07:59,180 --> 00:08:00,120 White bread. 139 00:08:00,180 --> 00:08:01,720 Very clean. 140 00:08:02,600 --> 00:08:04,180 So that brings me to my second point. 141 00:08:04,180 --> 00:08:16,320 Even though information can be gathered or stored automatically, it needs to be confirmed manually by human eyes, usually, for the most part, for anybody who's really trying to look for subjects, targets. 142 00:08:16,320 --> 00:08:19,460 So that's the second thing that I realized, and that's what got me started here. 143 00:08:20,340 --> 00:08:24,460 Now, before we go on, let's do a little bit of a brief historical context of disinformation. 144 00:08:25,400 --> 00:08:30,400 Sun Tzu, I know, everybody in the information security field talks about Sun Tzu and the art of war. 145 00:08:30,400 --> 00:08:30,820 Well, guess what? 146 00:08:30,820 --> 00:08:32,580 Again, this is my favorite book. 147 00:08:32,580 --> 00:08:33,680 I read it once a year. 148 00:08:33,680 --> 00:08:37,300 And we're at a hacker conference, so deal with that as you may. 149 00:08:37,660 --> 00:08:42,140 But he stressed the importance of deception in warfare. 150 00:08:42,140 --> 00:08:45,640 And to me, everything is warfare. 151 00:08:45,640 --> 00:08:50,180 Not just warfare, but everything to me is seen through the eyes of warfare. 152 00:08:50,180 --> 00:08:54,440 Now, I don't necessarily mean violence, but just strategy, ways of thinking. 153 00:08:54,440 --> 00:08:55,660 To me, it's all warfare. 154 00:08:56,120 --> 00:08:58,500 Now, the second part, ninjas. 155 00:08:58,500 --> 00:09:00,820 So we fast forward a little bit, a couple hundred years. 156 00:09:02,280 --> 00:09:04,740 Ninjas, they encouraged the legends. 157 00:09:04,740 --> 00:09:09,540 So if people thought that they were ghosts or Tengu demons in the forest, they didn't stop that. 158 00:09:09,540 --> 00:09:10,420 They didn't correct it. 159 00:09:10,420 --> 00:09:12,880 So they let that information spread. 160 00:09:12,880 --> 00:09:14,800 They let that out into the wild. 161 00:09:14,800 --> 00:09:20,340 I wanted to put a picture of ninjas there, but Google stock photos kind of sucked. 162 00:09:21,540 --> 00:09:22,000 So... 163 00:09:23,740 --> 00:09:25,000 You're welcome. 164 00:09:26,000 --> 00:09:27,340 I look a little bit like Maui. 165 00:09:27,340 --> 00:09:28,080 No, I'm kidding. 166 00:09:28,220 --> 00:09:31,360 Okay, so now we're talking about the American Revolutionary War. 167 00:09:31,360 --> 00:09:36,560 So here, General George Washington, six-star general, my favorite general. 168 00:09:38,200 --> 00:09:40,000 He had the Culper Spy Ring. 169 00:09:40,000 --> 00:09:42,280 Who in here remembers the Culper Spy Ring? 170 00:09:42,280 --> 00:09:44,200 Saw a turn on AMC, right? 171 00:09:44,200 --> 00:09:45,260 You saw that show. 172 00:09:45,260 --> 00:09:53,160 What he would do is he would buy swaths of material, military aid material, and just kind of place it in places. 173 00:09:53,280 --> 00:09:55,340 Just to fuck with the British. 174 00:09:56,640 --> 00:09:58,460 Disinformation, okay? 175 00:09:58,600 --> 00:10:01,420 Here in World War II, we have Operation Mincemeat. 176 00:10:01,420 --> 00:10:03,360 Who remembers that Netflix movie? 177 00:10:04,920 --> 00:10:08,060 Ian Fleming from James Bond was involved in that, right? 178 00:10:08,060 --> 00:10:12,180 That's an inflatable tank from the International Spy Museum. 179 00:10:12,360 --> 00:10:13,360 Really awesome. 180 00:10:13,360 --> 00:10:17,740 So they would just place inflatable tanks to show, like, movements of units, right? 181 00:10:17,740 --> 00:10:19,100 Cool disinformation. 182 00:10:19,440 --> 00:10:21,200 Next we have the Cold War. 183 00:10:21,460 --> 00:10:22,540 All of it. 184 00:10:26,960 --> 00:10:28,200 That one hit hard. 185 00:10:28,200 --> 00:10:28,920 Cool. 186 00:10:30,100 --> 00:10:32,160 And then we fast forward to social media. 187 00:10:32,160 --> 00:10:38,960 Now the cool thing about today, the present day, is that you don't have to be a huge organization to really work with disinformation campaigns. 188 00:10:38,960 --> 00:10:45,920 You have social media, you have a phone in your pocket, you can start to spread these rumors about yourself or whoever, right? 189 00:10:46,240 --> 00:10:50,540 So, social media, power to the people, or whatever you want to call it. 190 00:10:51,940 --> 00:10:56,140 Alright, so, I actually did some research, so not all of this is bullshit. 191 00:10:57,620 --> 00:11:03,620 These are disinformation tactics according to CISA, the Cybersecurity and Infrastructure Security Agency. 192 00:11:03,620 --> 00:11:07,180 So, these are my words, these are their words, okay? 193 00:11:07,180 --> 00:11:11,260 The ones that are highlighted are going to be what we concentrate on today. 194 00:11:11,840 --> 00:11:14,000 So, let's go through these. 195 00:11:14,260 --> 00:11:15,640 The first one. 196 00:11:15,980 --> 00:11:17,280 Hold on. 197 00:11:19,040 --> 00:11:19,560 Yes. 198 00:11:19,560 --> 00:11:22,980 Cultivate fake profiles and personas. 199 00:11:23,060 --> 00:11:24,760 Sock puppets, aliases. 200 00:11:25,640 --> 00:11:26,400 Okay. 201 00:11:26,620 --> 00:11:27,920 Real quick question. 202 00:11:27,920 --> 00:11:30,060 How many people actually still use their handle? 203 00:11:31,080 --> 00:11:32,940 That's my point. 204 00:11:33,400 --> 00:11:34,300 Right? 205 00:11:34,300 --> 00:11:36,460 Alright, anyway, next point. 206 00:11:38,780 --> 00:11:40,620 So, there's AI and deepfakes and stuff. 207 00:11:40,620 --> 00:11:42,520 Everybody's talking about AI this year. 208 00:11:42,520 --> 00:11:44,420 We don't have to because it's all out there. 209 00:11:44,420 --> 00:11:47,020 And we won't be focusing on that today, but it's out there. 210 00:11:47,020 --> 00:11:49,340 Again, it's one of the A points here. 211 00:11:50,340 --> 00:11:54,100 We have devise or amplify conspiracy theories. 212 00:11:54,900 --> 00:11:55,840 Hold on. 213 00:11:56,180 --> 00:12:01,280 Sorry, my screen is low to conserve battery. 214 00:12:01,280 --> 00:12:03,080 So, let me fix that really quick. 215 00:12:05,480 --> 00:12:06,200 Okay. 216 00:12:06,460 --> 00:12:07,080 Where was I? 217 00:12:07,080 --> 00:12:08,200 I was on third, right? 218 00:12:08,600 --> 00:12:09,540 Okay, cool. 219 00:12:09,840 --> 00:12:13,020 Alright, fourth one is astroturfing and flooding the information environment. 220 00:12:13,240 --> 00:12:13,960 Example. 221 00:12:16,480 --> 00:12:16,940 Sorry. 222 00:12:16,940 --> 00:12:19,020 Fifth one is abuse alternative platforms. 223 00:12:19,440 --> 00:12:21,820 Sixth one is exploit information gaps. 224 00:12:21,820 --> 00:12:22,760 That's a good one. 225 00:12:23,160 --> 00:12:24,520 Seventh one, and we'll get into that one. 226 00:12:24,520 --> 00:12:25,300 There's an example of that. 227 00:12:25,300 --> 00:12:26,260 That's why it's in red. 228 00:12:26,260 --> 00:12:29,440 And the seventh one is manipulate unsuspecting actors. 229 00:12:29,440 --> 00:12:30,120 Useful idiots. 230 00:12:30,280 --> 00:12:32,280 Unfortunately, it could be friends and family. 231 00:12:33,460 --> 00:12:37,680 You might need their help, but they won't know that you're helping them or that they're helping you. 232 00:12:37,840 --> 00:12:39,960 And the last one is spread targeted content. 233 00:12:39,960 --> 00:12:45,800 So, if you know that the person who's trying to target you is looking for specific things about you, push that out there. 234 00:12:45,800 --> 00:12:48,680 But, of course, it's going to be fake because it's okay to lie on the internet. 235 00:12:51,160 --> 00:12:51,580 Okay. 236 00:12:51,580 --> 00:12:57,340 So, we're going to be talking about disinformation by profile example or profile aspects. 237 00:12:57,340 --> 00:13:01,560 Aspects about yourself or aspects about maybe the person that you're trying to protect. 238 00:13:01,640 --> 00:13:04,740 So, the first one is physical appearance. 239 00:13:05,000 --> 00:13:08,540 I know everybody likes to post selfies or whatever. 240 00:13:08,540 --> 00:13:09,520 Maybe not me so much. 241 00:13:09,520 --> 00:13:10,440 We'll see. 242 00:13:11,320 --> 00:13:13,620 Next one is location and events. 243 00:13:13,620 --> 00:13:18,440 So, where is this person or where are you pretending to be? 244 00:13:18,440 --> 00:13:21,520 These are aspects of what you're trying to fuck with. 245 00:13:23,680 --> 00:13:25,180 Professional or social status. 246 00:13:25,180 --> 00:13:28,900 Everybody wants to tout how awesome they are online. 247 00:13:29,640 --> 00:13:31,040 Maybe me, not so much. 248 00:13:32,220 --> 00:13:34,900 Next one is romantic and interpersonal relationships. 249 00:13:34,900 --> 00:13:45,580 This is a good one because if you're being stalked, a lot of times it's probably because there's a romantic interest or at least that's what I've come across when I'm helping people. 250 00:13:46,860 --> 00:13:47,520 Okay. 251 00:13:48,040 --> 00:13:49,740 New tattoo, but who it is? 252 00:13:50,140 --> 00:13:52,720 Well, does anybody recognize this logo? 253 00:13:54,340 --> 00:13:55,520 Vegas Golden Knights, right? 254 00:13:55,520 --> 00:13:57,220 They just won the Stanley Cup. 255 00:13:57,300 --> 00:14:03,020 I did say that I was a BA in psychology from UNLV, University of Nevada, Las Vegas. 256 00:14:03,740 --> 00:14:06,280 I mean, that does look like my skin tone. 257 00:14:06,860 --> 00:14:10,180 I think it could be me, but I'm not going to say shit. 258 00:14:10,860 --> 00:14:14,080 I'm just going to post it up and let other people fill in the blanks. 259 00:14:14,080 --> 00:14:25,560 Which brings up my next point or my next green point here is when you post without context, you let the person who's observing you or looking after you to fill in the blanks. 260 00:14:25,560 --> 00:14:27,780 No comments, just post it out there. 261 00:14:27,780 --> 00:14:34,800 Let them assume that you are making life changes or updating things about you, et cetera, et cetera. 262 00:14:34,800 --> 00:14:38,560 To me, that's a major point, is let them fill in the gaps. 263 00:14:38,560 --> 00:14:39,120 Okay ? 264 00:14:40,540 --> 00:14:41,880 Next one. 265 00:14:42,280 --> 00:14:47,480 Now, I don't know who Rebecca Black is, but I can't wait for this event. 266 00:14:51,360 --> 00:14:59,700 Now, realistically, because if you really know me, like, oh, maybe I would be interested in the RSA conference or going to Blackhead or something like that. 267 00:14:59,720 --> 00:15:05,480 So I would put something a little bit more realistic, maybe leaning towards something, but I'm not going to go. 268 00:15:05,480 --> 00:15:05,980 Right? 269 00:15:06,160 --> 00:15:08,840 The point being, you post something, you can't wait for this event. 270 00:15:08,840 --> 00:15:10,680 Did I say anything about attending? 271 00:15:11,320 --> 00:15:11,840 No. 272 00:15:11,840 --> 00:15:18,440 And so again, we're letting the seeker fill in these gaps, fill in these assumptions. 273 00:15:19,120 --> 00:15:23,420 Let them think that they know what we're about to do, what we're going to be doing. 274 00:15:23,480 --> 00:15:23,960 Okay ? 275 00:15:24,660 --> 00:15:27,520 CISA points 3, 4, and 6. 276 00:15:27,520 --> 00:15:32,700 So we are devising and amplifying conspiracy theories about where we are or what we're about doing. 277 00:15:32,700 --> 00:15:33,360 Right? 278 00:15:33,780 --> 00:15:36,460 We're astroturfing the information environment. 279 00:15:36,460 --> 00:15:40,820 So we're putting stuff out there that just starts to seed their own assumptions. 280 00:15:40,820 --> 00:15:46,560 We're starting to, like, let them fill in the gaps, let them fill in what they're doing, or what they think that we're doing. 281 00:15:46,920 --> 00:15:50,800 And then we're, oh, that was 4, exploiting the information gaps. 282 00:15:51,360 --> 00:15:54,060 Yeah, and astroturfing and flooding the information environment. 283 00:15:54,260 --> 00:15:55,440 They kind of go hand in hand. 284 00:15:56,720 --> 00:15:58,300 Okay, another example here. 285 00:15:58,460 --> 00:16:01,620 To me, this is a very important one, especially in our community. 286 00:16:01,620 --> 00:16:02,180 Okay? 287 00:16:02,560 --> 00:16:04,100 I am not Severus Snape. 288 00:16:04,620 --> 00:16:05,920 I do like his hair. 289 00:16:06,800 --> 00:16:09,140 If you saw me yesterday, you would know that I like his hair. 290 00:16:10,160 --> 00:16:12,580 I change this daily, by the way. 291 00:16:12,780 --> 00:16:14,720 But I have a question for you. 292 00:16:18,780 --> 00:16:20,440 And it's blocked. 293 00:16:22,200 --> 00:16:24,220 Are you currently employed? 294 00:16:24,560 --> 00:16:25,420 Yes. 295 00:16:25,420 --> 00:16:26,220 Okay. 296 00:16:26,220 --> 00:16:29,060 Are you currently looking for employment? 297 00:16:29,320 --> 00:16:30,370 No. 298 00:16:31,200 --> 00:16:32,220 Okay. 299 00:16:32,220 --> 00:16:37,640 Does your current employer want you to have an online presence professionally on LinkedIn? 300 00:16:37,890 --> 00:16:38,940 No. 301 00:16:39,400 --> 00:16:40,360 Okay. 302 00:16:40,360 --> 00:16:43,340 Well, then, LinkedIn is a disinformation tool. 303 00:16:43,420 --> 00:16:50,620 But we often use it as, like, God, it is not just our resume for professionalism, but, like, our life. 304 00:16:50,800 --> 00:16:51,680 Sometimes. 305 00:16:51,900 --> 00:16:52,760 I worked here. 306 00:16:52,760 --> 00:16:54,680 I worked there between these dates. 307 00:16:55,100 --> 00:16:55,820 Okay. 308 00:16:56,460 --> 00:16:57,720 Nobody's asking for that information. 309 00:16:57,720 --> 00:17:00,300 You're volunteering it if you're not looking for employment. 310 00:17:00,300 --> 00:17:01,860 You're volunteering that information. 311 00:17:01,860 --> 00:17:03,460 And you know what you can do on the internet? 312 00:17:03,460 --> 00:17:05,260 You can change things. 313 00:17:05,260 --> 00:17:08,300 So, if you're looking for employment, yeah, clean it up. 314 00:17:08,880 --> 00:17:11,740 If you're not looking for employment, use it. 315 00:17:11,740 --> 00:17:12,800 Use it as a tool. 316 00:17:12,800 --> 00:17:15,340 Use it as part of your disinformation campaign. 317 00:17:16,540 --> 00:17:17,600 Fuck with things. 318 00:17:19,800 --> 00:17:20,820 Again, CISA. 319 00:17:20,900 --> 00:17:24,420 Okay, so here we have cultivate fake personas. 320 00:17:24,560 --> 00:17:26,520 Or at least half-truths. 321 00:17:26,520 --> 00:17:28,060 Things that can be a little blurry. 322 00:17:28,060 --> 00:17:29,180 Things that can change. 323 00:17:29,180 --> 00:17:30,500 Things that are, like, what? 324 00:17:33,440 --> 00:17:34,160 Astroturfing. 325 00:17:34,780 --> 00:17:36,180 Exploiting information gaps. 326 00:17:36,180 --> 00:17:38,120 And spreading targeted content. 327 00:17:38,120 --> 00:17:47,700 So, one thing that I have in a couple of slides next is you want to you want to go where the seekers are looking for you. 328 00:17:47,700 --> 00:17:51,500 You want to go where you think that they're going to pull information. 329 00:17:51,680 --> 00:17:53,260 They want to know about your profession. 330 00:17:53,260 --> 00:17:55,220 They want to know about your professional life. 331 00:17:55,220 --> 00:17:59,140 They want to know about your you know, maybe marital status or whatnot. 332 00:17:59,140 --> 00:18:02,080 Or they want to know about what's going on in your life. 333 00:18:02,080 --> 00:18:04,860 Because their stalkers are just people who are looking for you. 334 00:18:05,100 --> 00:18:06,600 Use that information. 335 00:18:06,600 --> 00:18:07,920 It's a game of cat and mouse. 336 00:18:07,920 --> 00:18:09,900 It's like rock, paper, scissors. 337 00:18:11,900 --> 00:18:12,960 The dating game. 338 00:18:12,960 --> 00:18:14,220 Now, caveat. 339 00:18:14,240 --> 00:18:15,640 Again, not my picture. 340 00:18:16,820 --> 00:18:19,700 I let my brother put in pictures. 341 00:18:20,140 --> 00:18:21,660 So that's all his shit. 342 00:18:22,760 --> 00:18:24,580 But they're cute, so I left them in there. 343 00:18:25,380 --> 00:18:25,980 Alright. 344 00:18:26,300 --> 00:18:31,780 So, the thing about this is you've got to be very transparent if you have a significant other. 345 00:18:31,780 --> 00:18:36,300 If you're married or whatever, make sure they know what the fuck you're doing here. 346 00:18:36,700 --> 00:18:38,240 So that you don't get in trouble. 347 00:18:39,520 --> 00:18:43,200 But, you are astroturfing with passion. 348 00:18:44,320 --> 00:18:49,880 So you make a fake dating profile, you keep it active, except of course the part where you're taken. 349 00:18:50,340 --> 00:18:52,060 But you just put stuff in there. 350 00:18:52,060 --> 00:18:56,740 Put stuff in there that maybe your stalker is kind of interested in seeing. 351 00:18:57,340 --> 00:18:59,440 A selfie, but it's not your body. 352 00:19:00,660 --> 00:19:02,840 Things that are maybe you, but not you. 353 00:19:02,840 --> 00:19:04,380 Like that tattoo earlier. 354 00:19:04,700 --> 00:19:06,040 On my right calf. 355 00:19:06,960 --> 00:19:08,160 My right calf. 356 00:19:09,380 --> 00:19:09,900 Alright. 357 00:19:09,900 --> 00:19:16,120 Again, the fourth point here is your targets will search in places where they want to confirm information. 358 00:19:16,340 --> 00:19:22,280 They want to look at dating profiles or professional profiles to see what they can find there about you. 359 00:19:22,480 --> 00:19:23,800 Give that to them. 360 00:19:23,800 --> 00:19:25,620 Just don't give them real information. 361 00:19:26,020 --> 00:19:28,660 We've gotten sloppy. 362 00:19:28,660 --> 00:19:30,740 We've gotten sloppy with what we do on the internet. 363 00:19:30,740 --> 00:19:33,240 That's a big point of today. 364 00:19:34,380 --> 00:19:36,840 Now, I didn't put the list there, but there's a set of points. 365 00:19:36,840 --> 00:19:39,640 1, 4, 5, 6, and 8. 366 00:19:39,900 --> 00:19:43,740 Well, we've been covering pretty much this whole presentation. 367 00:19:45,760 --> 00:19:49,480 Now, where do we start with building disinformation campaigns? 368 00:19:49,480 --> 00:19:54,960 Well, one thing I've realized when coming to these conferences is that everybody likes putting things in frameworks. 369 00:19:54,960 --> 00:19:57,980 We have the Social Engineering Framework. 370 00:19:57,980 --> 00:20:00,480 We have the OSINT Framework, which is what you see here. 371 00:20:00,480 --> 00:20:03,420 We have frameworks that we put everything around or in. 372 00:20:03,480 --> 00:20:06,240 So, where do we start with disinformation campaigns? 373 00:20:06,240 --> 00:20:08,800 Well, here's the OSINT Framework. 374 00:20:09,300 --> 00:20:10,460 osintframework.com. 375 00:20:10,460 --> 00:20:15,960 So, if you go there or if you go to the GitHub, you'll see resources of where you can search for things. 376 00:20:15,960 --> 00:20:22,140 Public records, business licenses, dating, phone number lookup, address lookup. 377 00:20:22,180 --> 00:20:28,620 Use this as a guide to filtering in and pushing in fake information, bad information, disinformation. 378 00:20:29,740 --> 00:20:30,880 Is it misinformation? 379 00:20:31,380 --> 00:20:32,740 Only if it's an accident. 380 00:20:36,160 --> 00:20:38,240 Now, key points to successful campaigns. 381 00:20:38,240 --> 00:20:40,240 Now, this is just what I've found to be successful. 382 00:20:41,240 --> 00:20:43,540 Anybody here in the audience might have other ideas, right? 383 00:20:43,540 --> 00:20:46,020 And I am more than willing to discuss with you. 384 00:20:46,960 --> 00:20:48,220 But the first one. 385 00:20:48,360 --> 00:20:50,600 Fact and fiction, of course, needs to be blurry. 386 00:20:50,600 --> 00:20:52,260 There's going to be elements of fact and fiction. 387 00:20:52,260 --> 00:20:53,880 Some of this is true, maybe. 388 00:20:53,880 --> 00:20:55,140 Some of this is false. 389 00:20:55,140 --> 00:20:57,520 But we can't really confirm which is which. 390 00:20:57,520 --> 00:20:58,720 And that's the point. 391 00:20:58,780 --> 00:21:04,400 We don't want to be completely outlandishly false because that's just ridiculous and they'll pick up on that. 392 00:21:04,400 --> 00:21:07,840 We don't want to be completely truthful because, well, that's not the goal. 393 00:21:07,840 --> 00:21:08,340 Okay? 394 00:21:08,340 --> 00:21:09,980 So you've got to blur the lines. 395 00:21:10,000 --> 00:21:11,540 You've got to make it gray and blurry. 396 00:21:12,840 --> 00:21:13,680 Next one. 397 00:21:13,880 --> 00:21:16,280 Plausible but not outlandish. 398 00:21:16,280 --> 00:21:21,800 It needs to lean in the direction that you want your seeker to kind of go towards. 399 00:21:21,800 --> 00:21:23,900 You want to guide them in a certain direction. 400 00:21:23,900 --> 00:21:28,280 But you don't want it to be so off the side that it's ridiculous and unbelievable. 401 00:21:28,460 --> 00:21:30,720 So, for instance, Rebecca Black. 402 00:21:30,980 --> 00:21:32,360 Again , not my picture. 403 00:21:32,360 --> 00:21:39,440 I would have put something up there like the RSA conference or something that I would realistically attend but I'm not actually going to attend. 404 00:21:39,680 --> 00:21:39,860 Okay ? 405 00:21:39,860 --> 00:21:42,900 So, again, make it plausible not outlandish. 406 00:21:44,080 --> 00:21:45,340 And the next one. 407 00:21:45,340 --> 00:21:47,580 Meet your pursuers where they look. 408 00:21:47,580 --> 00:21:55,360 So , something that I've touched upon here earlier is if we know that they're interested in our location, fuck with location data. 409 00:21:55,360 --> 00:22:01,200 If we know that they're interested in our marital or interpersonal relationships, inject information there. 410 00:22:01,200 --> 00:22:03,580 Go where the seekers are looking. 411 00:22:03,800 --> 00:22:05,100 Purposely go there. 412 00:22:06,520 --> 00:22:07,260 And the last one. 413 00:22:07,260 --> 00:22:08,840 We're going to keep it... I think this is the last one. 414 00:22:08,840 --> 00:22:13,840 We're going to keep it subtle, simple with mixed effect. 415 00:22:13,840 --> 00:22:14,420 Okay? 416 00:22:14,580 --> 00:22:15,320 Make it mixed. 417 00:22:15,320 --> 00:22:16,220 Make it blurry. 418 00:22:18,680 --> 00:22:22,640 And, uh, the big one here today, too, also is leave things open to interpretation. 419 00:22:22,800 --> 00:22:24,540 You know, we put the tattoo out there. 420 00:22:24,540 --> 00:22:25,060 Is it ours? 421 00:22:25,060 --> 00:22:25,700 We don't know. 422 00:22:25,700 --> 00:22:26,580 No comment. 423 00:22:26,660 --> 00:22:27,120 Right? 424 00:22:27,120 --> 00:22:27,400 Fuck it. 425 00:22:27,400 --> 00:22:28,340 You figure it out. 426 00:22:30,420 --> 00:22:32,500 Now, there are some downsides to this, right? 427 00:22:32,760 --> 00:22:37,880 So, some of the downsides is your loved ones and your family and friends can get caught up in the mix. 428 00:22:37,920 --> 00:22:40,680 They don't know necessarily if you're not talking to them every day. 429 00:22:40,680 --> 00:22:43,820 You post a picture of a tattoo and your mom's like, what the fuck? 430 00:22:43,820 --> 00:22:45,840 I'm going to scrape that off with a butter knife. 431 00:22:46,320 --> 00:22:47,340 I've heard that before. 432 00:22:49,960 --> 00:22:54,780 So, it leaves everybody open to interpretation, not just your target. 433 00:22:54,880 --> 00:22:55,340 Okay? 434 00:22:55,420 --> 00:23:04,220 So, some of the people who are innocent bystanders will assume things and they would probably ping you on the side or ask, yo, what's up with the new thing? 435 00:23:04,220 --> 00:23:05,980 Or, what's up with these life changes? 436 00:23:05,980 --> 00:23:10,080 So, there could be a little bit of blurriness there, but that's kind of the point, though. 437 00:23:10,080 --> 00:23:16,040 The more people that kind of believe what you're showing out there, the more believable it is and they start to spread. 438 00:23:16,040 --> 00:23:20,760 That news starts to spread among friends and then eventually could hit your intended target. 439 00:23:22,080 --> 00:23:24,760 The other downside is, now here's the thing. 440 00:23:24,760 --> 00:23:28,340 Disinformation can leak into your real world or your real life. 441 00:23:28,680 --> 00:23:38,680 So, I wouldn't fuck with the public record, really, because you might need that in a background check or something where you need accurate information. 442 00:23:38,780 --> 00:23:39,300 Okay? 443 00:23:39,300 --> 00:23:46,720 So, just be careful with what you're putting out there and be ready to explain what you're doing when somebody asks you, what is this name? 444 00:23:46,720 --> 00:23:47,960 Or, what is that name? 445 00:23:47,960 --> 00:23:50,800 Well, sir, that is what I'm doing over here. 446 00:23:50,800 --> 00:23:52,460 That is completely what's going on here. 447 00:23:52,840 --> 00:23:53,300 Yeah. 448 00:23:53,500 --> 00:23:58,440 These are two downsides that I found that you'll want to look out for. 449 00:24:00,180 --> 00:24:09,420 And here are the references for the OSINT framework, the GitHub there, and the top part is the CISA disinformation tactics. 450 00:24:09,420 --> 00:24:18,900 It's a whole PDF and explanation of what they have advised on what it is, how it works, and how to counteract these disinformation tactics. 451 00:24:23,940 --> 00:24:27,320 And I took this whole time not having a sip of that drink. 452 00:24:27,320 --> 00:24:28,000 Oh , well. 453 00:24:30,580 --> 00:24:33,620 My friends in the audience know this is rare for me. 454 00:24:34,420 --> 00:24:43,740 But, okay, so I will be answering questions next door, and also I usually go down to the center bar and throw two or three back with everybody who wants to come and hang out. 455 00:24:44,320 --> 00:24:48,900 Other than that, these are my references, and that is I am the disinformation campaign. 456 00:24:48,900 --> 00:24:50,180 Oh, one more quick point. 457 00:24:50,180 --> 00:24:56,320 When I say I am the disinformation campaign, I don't want you guys to think I as in Master Chen. 458 00:24:56,400 --> 00:25:01,880 I want you to start thinking of I am the disinformation campaign as yourselves. 459 00:25:02,480 --> 00:25:04,360 I am the disinformation campaign. 460 00:25:04,360 --> 00:25:07,740 I am responsible for the lies and what's out there on the internet. 461 00:25:08,980 --> 00:25:09,900 Internalize this. 462 00:25:09,900 --> 00:25:11,260 Make this a part of you. 463 00:25:11,260 --> 00:25:13,460 Make this something that you can use as a tool. 464 00:25:14,420 --> 00:25:16,700 Be the hacker that you want to see in the world. 465 00:25:29,260 --> 00:25:31,740 Thank you very much, and thank you Recon Village, guys.