Hi, everyone. Good morning. That's the kind of cheer we need. So thank you so much for
coming to our DEF CON this year, Recon Village. So let's give a big round of applause for
Recon Village. So happy to see so many people. It's like the room full and I can see some
people standing out there as well. We're going to be introducing our first speaker,
our keynote speaker, who's going to be talking about something very interesting, something
very hot right now. So who all have heard about AI? No? No? No? Yes? Maybe? So he's
going to be speaking about reshaping reconnaissance, AI's role in open source intelligence. So
let's welcome Matt Edmondson. And he's actually founder for Argilius Labs, hacker, forensicator,
science author, practical open source intelligence course, principal instructor, Black Hat speaker,
OSCP holder, featured in Wired, and so many more things to say about him. But what I'm
going to do is... I'm going to shut my mouth now and I'll give the stage to him. But let's
give him a round of applause. I met her half an hour ago and I'm already deeply afraid
of her. Also, the hardest part of this talk is going to be not moving for an hour with
the stationary mic. I literally might explode. So she did a good job introducing me. Almost
22 years as a federal agent, started up a lot of OSINT units with the government. Louder?
All right. All right. I got to get real close and intimate with this microphone. Thank you
for letting me know. I'm the author of the SANS SEC 497 practical OSINT course, Black
Hat speaker, featured in Wired, et cetera, et cetera. What are we going to talk about
today? A little bit of introduction. We'll talk about using AIML for profile creation,
see what that looks like real quick. For processing, which I think is honestly what we'll probably
end up spending most of our time, kind of processing, massaging data. Code analysis
and end it with a little bit of report writing. It's kind of weird. If we're being perfectly
honest, if we gave this talk a year ago, like these would just be buzzwords, right? I mean,
seriously, for most of us in here. AIML. I think I joked when I was speaking at the
2021 SANS Summit. I wrote a persistent monitoring tool. And I said, yeah, if I was trying to
get funding, if I was trying to sell it, I would say it uses AIML. It's just lists and
common sense and some shoddy Python code. Really it is. And all of a sudden a year later,
we actually have usable things that do produce some amazing, amazing capabilities, right?
And you're already starting to see some people think that this is just a fad. We live in an
industry full of fads, right? Next generation this. There's always some new next thing that's
going to be the savior. It never actually pans out. And so it's very, very easy to think that
it's going to be the same way with some of these capabilities. But I really don't think that's
going to be the case at all. I really, really don't. I originally started playing with this
tech late last year, like I think a lot of us probably did. And I was in curiosity and I just
started using it more and more. I was amazed by the results. And usually how I was using it was
to help me writing code, right? I'm not a professional programmer. I can write shoddy
Python code that helps me, my friends, my teammates and kind of gets the job done.
And all of a sudden with ChatGPT, I was writing that code a lot quicker, right? I was just really,
really enjoying it. And I saw someone on an OSINT Discord say, yeah, ChatGPT, it's neat,
but it's not really useful for OSINT. And I'm like, man, I'm using it every day, right? And
so that's when I decided to do a webinar on how ChatGPT for OSINT. And when I did it, I didn't
just want to talk about how I was using it. And so I actually forced myself to sit there and think,
how could we use it in every phase of the intelligence cycle? And as I started playing
with it more and more, frankly, I was more and more amazed. I just really, really truly was.
The good news is the hard stuff is getting more and more unnecessary every day, right? You don't
really have to understand the math behind it. The same way if we're being honest at a hardware level,
my phone does a lot of stuff that I don't understand exactly how it works.
But I use it every single day. And this technology is quickly getting there, very quickly.
If anyone's ever tried to play with the local models, right? Like Lama or some of those others.
If we think back even four or five months ago, what do these things want you to do? Oh, download
this. Download all these weights. Train the model. This is about it. You don't have to do that
anymore. It's like one click. I mean, seriously, right? It's like a pip install. And then you have
things running. And it's just going there. And I like that. And it's not just installing and using
local. I think it's kind of everything in this space. Right now for 2023, right? One of the hot
jobs has been prompt engineering. It's getting very, very good at asking these models questions
and getting the results you want. That's not going to be a job in like two years for the most part.
It's really, really not. Because they're getting better and better at knowing what they want,
right? When I was a little kid, I tried to draw. I can't draw, right? I can't draw a
straight line with a ruler. I'm horrible. But now, like if you look at all these graphics, I made
them myself using my words, right? Using mid journey. And you used to have to give mid journey
like these long, complicated commands to try to get decent output. Nowadays you can give it two
words and get pictures like this, right? So it's heading in the right direction. And I'm very happy
to see it. It's going to change the way that a lot of things are getting done, frankly. It just is,
right? And it's going to be important to be at least familiar and comfortable with it. There's
someone named Daniel Missler who's brilliant. He comes out with a newsletter each week on kind of
trends in technology. If you like his stuff, you should definitely check it out. But he's mentioned
a few times something called like a K-shaped recovery, right? And as we start to think of what
this is going to change and how it's going to affect our industry and how it's going to affect
our jobs, it kind of makes sense that it's probably going to be very, very good for some people and
very, very bad for some people, right? If I was an artist right now, I would be terrified.
And it sucks because I appreciate artists because I don't have that capability. So I can just sit
there for hours and watch. Like I can go down to the strip and see someone with cans of spray paint
making pictures. I can watch them for hours. I'm mesmerized because that's not a skill set I have.
But now I'm making pictures like this, right? So like I said, if I was an artist, I'd be terrifying.
And so what he means by a K-shaped recovery is just like a capital A, right? Are you utilizing AI ML?
Probably going to be good for you. Are you not? It may not be the best. So it's just something
to think about. And like I said, we live in an industry full of trends. I was a black hat
yesterday and I saw a booth where they had like set up a coffin and candles saying something was
dead. It was probably the tackiest booth I've ever seen in my life. If you work for that company, I
apologize. But like I said, when we live in this industry, right, where there's so many things
that are fads and trends, it's really not hyperbole to say that things that haven't
been possible before now are. And it's kind of a silly example that I use, but the example that I
love is sentiment, right? Has anyone in here ever tried in the past to do sentiment analysis at
scale? It is a dumpster fire, right? Those of you that haven't tried, no, but it is a dumpster fire.
It's one of those things. It's like three lines of Python to implement, right?
Import text blob, get your score, you're good to go. But the score is iffy at best. And when I
looked at this, this was, we used to have a site called Twitter. It was pretty cool. It's something
else now. But when I was looking at a site to analyze sentiment, this was classified as the
most negative tweet. And if you look at it, this is bad AF. Y'all killed it. That's clearly very
positive, right? But everything that we throw it at says it's extremely negative. But now I just gave
it to Google Bard, and Google Bard said it's positive and takes the time to sit there and
explain why it's positive. We couldn't do this a year ago, right? At least not publicly. And so
this is just one example of, like I said, it's not hyperbole. The things that weren't possible
are now possible. And right now, like, honestly, this is kind of a good for demonstration
operationally. What? I would want positive, negative, or mixed. But now think about that.
When you're trying to set up persistent monitoring efforts, right? Why is sentiment so hard? Language
changes, right? Bad is actually good now sometimes, depending on the context. Sarcasm. Hey, great job,
Salvin. Real good to see you, right? These are the reasons why it's hard, but now these models are
doing a really, really good job with it. Let's take a look at... we've got a couple of examples that
I've shown before, and they're in here because they're really good, but then we have a lot of
new stuff too. So one thing, right? How can we actually use this technology creating sock puppet
accounts? And so here I asked chat GPT, can you give me 10 fake names for a French woman in her
30s? And it spits them out. I picked number five, Chantelle Rousseau. I then asked, can you recommend
10 usernames for a woman named Chantelle Rousseau? And it does it. This to me is hurts. This slide
just hurts. Yeah, I'm tall and handsome and charming and modest, but honestly, clever, right? Clever
is what's kind of gotten me along all these years. And now I look at the usernames that
chat GPT came up with, and I'm like, dammit, chat GPT is more clever than me, right? Chantellicious,
the Chantress, Chantelle C. Rousseau, Chante Rousse. These are like, there's like six names
that I will freely admit are better than anything I could come up with. And that hurts. That's one
less thing I got going for me, right? And now that we have the name, and now that we have the username,
and I know this went to small, I apologize, but I say, can you please fill out all the profile
information? And it gives me a date of birth, a city, her interests, and then a short bio right
in there, right? It really, really kind of is crazy. And so this is push-button automated now
to just come up with an accurate, right? And I've showed this to people from France, and they're
like, no, that looks spot on. This is push-button capability. But what about the profile pictures,
right? We have these things now to detect that a picture isn't real. Except most of the tech
that's detecting if a picture isn't real, they don't know what everyone in the world looks like,
and long story short, GAN stands for a generative adversarial network. And this was some researchers
at NVIDIA, the company that their stock is skyrocketing right now, right, because of this
stuff. But they make graphics cards, and their researchers had to come up with an algorithm to
detect faces. And so they made an algorithm to create faces, and basically generative adversarial
network. Generative because it actually makes something, and adversarial network because you
have two computer programs that you're battling against each other. And so, for instance, if we
make a program that makes counterfeit currency, and another program that detects counterfeit
currency, and we battle them together thousands, millions of times, what's eventually going to
happen is the counterfeiter is going to get so good that it's almost never going to get detected,
right? And so they came up with this algorithm to make faces, but there are tells, right? The
most common one is, if you've ever played with that site, this person does not exist,
and you take your fingers, and you cover eyes, and you hit refresh, refresh, refresh, all these
new faces, right? Your fingers never move. You're still covering the eyes. That's kind of its north
star. And so a lot of these tools, a lot of these plugins, etc, oh, we detect fake faces with a 99.82%
accuracy. No, you don't. You detect if it was generated with a GAN, right? And so a lot of
people are familiar with ChatGPT, obviously, but a lot of people haven't ever played around on a
site called Hugging Face. You ever have like a friend that always likes to brag that they were
on a band before anyone else, right? I was watching Green Day back when they were playing in bars in
Hemet, right? If you want to be that person in the AI ML space, and who doesn't, Hugging Face is where
you should be playing out. It's a lot like GitHub, except they actually let you set up spaces where
you can test and play with these codes. And one of the code out there right now is a project called
Face Swap, and Face Swap is pretty cool. It lets me take a picture of myself, mix in that bottom
person at the left, the far less handsome person in the lower left corner. That's actually a GAN
generated image, right? You can tell with the soulless little eyes there. And it lets me now mix
in elements from that GAN onto my picture. So even though I kind of mixed in attributes from a GAN,
if you look at my picture, it still has the same basic shape, the same basic, right, kind of angle.
The eyes aren't in the exact same spot. And so all these tools that brag that they have a 99.82%
accuracy, this is just a rip in the right biome, right? And so literally right now, we have the capability
with an API to generate profiles and generate profile pictures in seconds, right? And for those
of us that have to create accounts at scale, this is glorious. For those of us that are trying to
deal with propaganda networks, right, and the things that a lot of us are dealing with, this
is terrifying, right? That is absolutely the scary part. And right now, I don't honestly have a lot of
answers, but I think those of us in this room and those of us at home, we're going to be on the hook
to solve this problem, right? We're using these capabilities to generate these things at scale.
We're going to have to figure out ways that we can use these capabilities to detect them at scale,
right? And we can. And like everything else, this is going to turn into a cat and mouse game,
right? This AIML, it's like, what is it going to be good at? Yes, right? Seriously, yes. We just have
to get clever and creative about how we're going to use it and how we're going to deploy it.
Let's talk for a little bit about processing. Throughout my entire career with the government,
I would hear people say collection and analysis, right? And I think if any of you were in the
Gubby space, you always hear collection analysis, collection analysis. You're missing a step,
right? There's a step in between there, and that step is honestly where I lived most of my career,
and that step is processing. Processing is taking the data and actually putting it in a
format where it's suitable to be analyzed, right? I always joke, like, everyone says they want all
the data until you give them all the data, right? Seriously, people are like, I want all the data,
and you hand them like a 16 gigabyte SQL database of breach data, and they're just staring at it
like a hog looking at a wristwatch, right? No idea what's going on. And it's actually being able to
process that data, massage that, and put that in a format where people can analyze it. It could
be something like just translating it to a native language, right? To a language that you speak,
or whatever it is, but processing. It's a critical step, like I said, because of my technical skills,
most of my career, this is where I lived, is kind of taking these things that people didn't know how
to deal with and making it to where they could deal with it. And I got to tell you, this tech
is absolutely ridiculous at doing these things. Another example that I've used, but it's just too
perfect not to use, Conti, right? A lot of us have heard of that. Ransomware gang, been observed
since 2020, 2022, right? Last year, the government offered a reward of 10 million, I'd like 10
million dollars. Conti came out, right? If you're like a threat actor operating in Russia, right?
What are the rules, right? You really, for the most part, don't mess with other Russians, right?
That's where the malware tries to detect the language, and if Russia asks you to do something,
you do it, right? That's kind of the rules. And so obviously, Conti came out and expressed
support for the invasion of Ukraine. Well, not everyone in the group was on board, and so someone
leaked 60,000 messages from their internal chat. This sounds amazing, this is like beautiful, let's
read them. Cool, here they are. Once again, the font is small, I know, but number one, they're in
JSON. All right, the, you know, the addresses are a little weird, right? They end in a dot onion, got
some dark web stuff going on here, and the body, the text, right? It's all in Russian, right? It's all
in Cyrillic, it's all in Russian. We can do this, right? We have translate, we have human translators,
we have tech translator, translation engines are getting good, right? Translations are way better
than a lot of people think right now. We can make this happen, but it's going to be a little bit of
a pain in the butt, right? 60,000 messages, grab a Snickers. Here, I give the text to chat GPT and I
say, parse the body field in the JSON and tell me what the conversations are about.
It cannot be this easy. Damn it, it's this easy. Seriously, look at that. This person and this
person having a conversation about registering an external account for backup purposes,
these ones talking about their location, providing login details for several servers.
I didn't have to massage the JSON. I didn't have to translate the Russian
to English so I could understand it. I didn't have to do any of that. It just did it, right? Like I
said, it's to say that this is a fad, I think is crazy personally, because all of a sudden,
things that just were not possible at scale before now are. And this is one thing, too, where
it gets a little tricky, right? I was just, two weeks ago, I was teaching at a conference in New
York and all of the people for the conference were setting up, well, there were some union
workers that were just standing around watching, right? But they were getting paid. You had to
have the union workers there, right? And that's just, you know, there are some cities that are
like that. I'm not saying it's good or bad, but it's this, well, it's taking someone's job,
right? Like, no, you can't do that. I need to do that, because that's someone else's job, right?
I can't do that. That's someone else's. And so it's easy to think this and get afraid. Like I
said, if I was an artist, I'm going to be honest, I'd be terrified. But this tech isn't about
replacing people. It's about toll reduction, right? It's about taking the things that a human being
doesn't like and automating that and letting them focus on what we're good at, because there
are some things that humans are absolutely better at than this tech, especially right now. But if we
can use it so we can focus our time, I always think back to when I first ever used Python,
it was actually for GIS work, and I had one of my Intel analysts who every week had to generate a
report. She had to analyze certain activities that occurred in different regions and actually
come up with some stats for that, and this literally took her an entire day every week.
And I'm like, there's got to be a way to automate this, right, with some of these capabilities from
Esri. And I reached out to the company. I'm like, hey, is it possible to use these tools externally
and just tap the Python API? And they're like, I don't know. No one's ever asked me that. Cool.
Took me about two days, but I was able to cobble together some code and automate that and take
something that was literally taking her a full day every week and made a push button run in about ten
minutes, right? She wasn't out of a job. We didn't convert her to part-time. It let her get rid of
something that she hated doing every week and focus on things that she was actually good at
and enjoyed a little bit more, right? So that's definitely the mindset that I try to keep in mind
as I think about how to use this. Like I said, I really think it's about toll reduction, not about
replacement, at least for right now and hopefully forever. I personally, you see all these cool
little parlor tricks that people are doing. I think the killer app right now for these large
language models like ChatGPT and Google BARD, and we'll talk more about BARD later, I really think
that the killer app is summarization, right? I give you just a mountain of text and you summarize it
for me, right? Just like those conversations we just looked at. We saw the power now of taking
text, but what about other stuff, right? What about audio and video? And for that, let's look at
something called a Whisper. If you've never seen Whisper before, you are in for a treat. Whisper is
ridiculous and it's got everything going for it and it is completely free. It's made by OpenAI,
the same company that makes ChatGPT. And there's a lot of times for a lot of reasons where you have
audio and video files that you actually need to transcribe, right? We need text from this. Whisper
automates that task. Here, I took a video from my personal trainer on how to, kind of advice on how
to meet your protein goals, and I sicked Whisper on it. Whisper is two lines to install. You have
to install a FFmpeg, like an open source audio video processor, and then it's just a pip install
Whisper. It is seriously that easy. Once you do that here, you see I say Whisper. I give it the
name of the video. It takes about 30 seconds of audio to analyze the language and detect it,
and then it just starts spitting out. The blur there is he dropped an F-bomb, right? I didn't
want an F-bomb in my talk. If I'm going to drop an F-bomb, it's going to be me, not a text.
And I'll try not to, I promise. But no, I mean, if we're looking at that, it's spot on, right?
And he's got a fairly thick Irish accent, but he's easy to understand. So this is impressive,
but it's easy to understand, and it's in English. What other languages does it support? Yes,
right? And like I said, I know this font is small, but that's a lot of languages right there. Some
are going to be better than others, right? It's going to have better support for English, the
popular languages, German, French, Russian, than it will for some of the more obscure ones, I'm
sure, there. But still, that is a ridiculous level of support. So I gave it English. It did good,
but how would it do with a foreign language and one that's not the easiest to understand there,
right? So Juan Huyabora, a.k.a. Spanish Laughing Man. A lot of us have probably seen his meme
videos, right? The AWS Exhibimon is just the GOAT. I've watched that probably 20 times.
So let's see how it does with him. First things first, it actually detects the language slightly
off, right? After 30 seconds, it detects it as Galician, like a mix of Spanish and Portuguese,
which from Spain, like, this actually kind of makes sense. And so here I aborted, just
control seat out, and I did it again, but I actually forced Spanish. So you see their language
ES, and it starts having no problem transcribing what is being said in the video. And guess what?
I can also do tac-tac translate, and now instead of just transcribing, it also translates to
English. We've seen what it does. We've seen the languages it supports. Would you believe me
if I told you that this capability was all offline? Because it is. Because it is. I wrote
up a blog post on this, and someone's like, there's no way that's offline. I'm like, let's
test it. So I fired up a cheap little nook, put Ubuntu on it, I installed Whisper, and I ran
it one time, because the first time you run it, it downloads one of the models. It downloads
the medium model by default. I think it was 461 megs. It took, like, three seconds to download,
seriously. Once it downloaded, and it ran one time, I stopped it, I disconnected the network
cable, showing the device was not hooked up to the internet in any way, shape, or form. I then
tried a different video, and it crushed it. Once again, that was in English. Cool. Let's try a
Spanish one, giving it the task to translate, and it does that. Locally, we are taking massive
amounts of audio, video, whatever we want, sucking the text out of it, and even translating it with
no internet connectivity. And once again, if you've ever tried to do things like this at scale,
and you see the quality of the output that it's producing, it's, like I said, to say it's
revolutionary, I think, is even an understatement at some points, right? And this is it, too. It's
an important thing to think about, and we're going to talk about it here in a little bit,
but we're at the very early phases of this technology, right? People like to point out flaws,
go down to a car museum, and look at a Model T. That's a cool car. Would anyone here want to use
that as a daily driver if you couldn't sell it and had to use it? That would be your worst life
choice ever, right? What we're playing with right now is the Model T of this tech. It really, really
is, right? And think of how far we've come, and how fast we've come, and I have no reason to believe
that this is going to be any different. Nothing is perfect, right? Sometimes these large language
models make things up. I was talking to a buddy of mine, a fellow SANS instructor, Mick Douglas,
about hallucinations. That's the term for it, right? When these large language models just
make stuff up, hallucinations. He was having ChatGPT write some .NET code for him, and he's
like, man, this code is clean, this code is beautiful. I didn't even know that function existed. It didn't.
That wasn't the worst one. ChatGPT is actually really good at commenting code, right? If you
try to use ChatGPT to crank out some code, it's pretty good about commenting it and about letting
you know what it's doing, which, from a learning perspective, is fantastic.
He asked it to write some code, and in the comments, it said, yeah, this, you know,
right here, what this is doing, this is actually referenced in this blog post, and it gave a link
to the blog post in the comments. He's like, this is so cool. He went to read the blog post.
It didn't exist. And he could find, and this is not a dumb person, he couldn't find any evidence
the blog ever existed. It wasn't he couldn't find the blog post. He doesn't think the blog ever
existed. And you hear stories like that. And it's very, very easy to say that this tech is not ready
for primetime, that this is a parlor trick, right? This is just another in a long line of fads in
this industry, so let's just pour a drink and go on to the next one and get it over with.
But I really don't think that's the case. And in this case, I think if we just abandon this,
and we decide that it's not perfect, so we don't want to use it, we're making a horrible mistake.
We're throwing the baby out with the bathwater, right? Goes all the way back to Voltaire,
who said, do not let perfect be the enemy of good, right? That is a very important concept
in so many things, right? I got John Hubbard here, good friend of mine, defense in depth,
right? We don't rely on any one piece of technology to defend our networks,
right? We have a collection of imperfect solutions that when used together leave us
much better off than we were before. And so yeah, that does not mean they have no value.
They absolutely do. I spent most of my career as a federal agent in intelligence, right? Because
of my technical skills that I kind of developed, I got sucked into that very early. And good
intelligence people, whether you're analysts, agents, whatever you are, but good intelligence
people will always take what they're hearing, and they'll always go directly to the operators
for ground truth, right? The actual boots on the ground, is this what you're seeing?
Does this actually make sense? Sometimes they say yes, sometimes they say no, that's not what's
going on, this is actually what's going on, and now you understand better. And the further you
are from the action, the more important this is, right? Just 100%. I spent a few years in Washington
DC working in some very cool places, but there you're removed from the front lines, you're
removed from what's going on, and that's when it was so important to go to the actual operators
and try to secure this ground truth. And so sometimes when I say where I think things are
going, it's a prediction, and sometimes it's just wishful thinking, like I just watched some
YouTube videos on meditation, I'm trying to wish this into existence. But this year, large language
models like chat GPT, generative AIs like mid-journey, stable diffusion, that's been all the rage.
What I really hope is that next year in 2024, one of the hottest terms we hear is grounding,
right? And a lot of us probably haven't heard of that term yet, but it's basically taking the
results from these large language models and running them through some known accurate data
to double check, right? To really increase the confidence that we have in these findings,
right? That we feel a little bit more comfortable about using it in ways that we don't feel
comfortable in using it right now. So like I said, I don't know if this is an actual prediction
or just what I want. I think it's a prediction. I do, I honestly do. I think this is going to be
kind of the hot term next year, taking known good data and kind of double checking at that
and trying to incorporate that and kind of taking this to the next level. Because once again,
I think we're honestly playing with the Model T version of this tech.
For now, these large language models, they can still be incredibly useful.
But what you need to think through is the risks versus the rewards of possible hallucinations
when you're using this, right? If you're sitting there using large language models
to analyze things and make recommendations that you're like acting on, Lord help you, right?
Like that's risky. That's very, very risky right now. But if you've got a bunch of data
that you're not doing anything with, and you use large language models, be it logs,
be it something else you're collecting, and you're using large language models to churn through that
and try to identify things that maybe you should look at, if you're not looking at it right now,
what in the heck is the downside? Like seriously, what is the downside of using it in that way?
And so right now with the current state of the tech, if we think about implementing this,
I think that's what we have to think about. We know that hallucinations are real. We see it.
If you've played with this tech, you've experienced it too. But the capability is so powerful, right?
We just think of what are the downsides, where it is appropriate to use and where it isn't.
And obviously, it kind of goes without saying in this crowd, but we want to think about OPSEC, right?
We want to think about putting these things into ChatGPT, and we've already seen some instances of that, right?
I gave ChatGPT on purpose some API creds the other day. I was testing something and asked it to write
some Python codes using these API creds. It yelled at me for giving it the API creds, but then it
generated the code, right? So it tells you not to, but then it does what you ask anyway.
And we have these local language models that are unbelievably impressive. If you've played with Lama,
if you've played with some of the others, Vicuna, when that came out, or now the new Lama 2,
what are they saying? I think they said Vicuna was what, like 92% to 93% of the capability of ChatGPT.
To have that running on a local system is amazing. But if you played with this tech,
and you have, like, normal consumer-grade hardware, then you know how unbelievably slow it is, right?
Unbelievably slow. Like, just through molasses. Very, very difficult to use. Right now, the GPUs
that, like, professionals are using with this are ridiculously expensive, right? Like, look up,
like, the NVIDIA A100s, and you see, like, these $16,000 video cards with 80 gigs of RAM.
Did you ever think that we would live in a world where you would see $16,000 graphic cards that
weren't even designed to be hooked up to a monitor? It's disgusting, right? And that's what it is,
is you have to load these large language models kind of into the RAM of your GPU,
otherwise the performance is even worse. And so if you're trying to do that on, like, an 8-gig
GPU, it's brutal. You need that more memory. And so that's another thing, and it's, like,
I don't know how much prediction, how much wishful thinking. I'm really hoping between NVIDIA, AMD,
maybe some other dark horses, or I don't know, Microsoft, Facebook, a lot of other companies
are looking at developing their own hardware now. But I hope we start to see some graphics card
hardware that's designed for consumers and it's designed for this. Because right now, if you look
at video cards with a 4090, the NVIDIA 4090 with 24 gigs of RAM, I think that's the most RAM we're
getting right now on a graphics card that's designed for a consumer. But the RAM, as the
video cards get faster and faster, the RAM almost just kind of comes along with it for the ride.
I really hope we start to see a trend where we're seeing cards that maybe don't have this cutting
edge performance. We don't need it for playing video games or whatever else we're doing, but it
has more RAM. Right? We start to kind of see it on that. Just the same way with cryptocurrency, right?
It's not the exact same problem, obviously. It's not one specific algorithm. But in cryptocurrency,
right, everyone was using video cards. And then what happened? They came out with ASICs, right?
They came out with those specialized devices that were a lot better, that use less power. I'm hoping
we see a similar thing. I'm hoping we see consumer-grade cards that focus more on RAM so we
can use these language models than what we have now. If you pay attention to social media, Twitter,
X, whatever it's named next month, right, whatever you're on, you always see people now, Reddit, the
ChatGPT. I think half the posts on the Reddit ChatGPT subreddit are on how ChatGPT is getting
dumber, right? It's just getting dumber. It's getting dumber. Kind of. Let's be honest. When this tech
first came out late last year and into, I think, probably about March, it was a race to impress us.
And it worked. It worked, right? That race was canceled. I hate to break it to you. They didn't
send out a notice. The reason the race was canceled, it's a new race now. It's a race to limit liability.
Right? Think about this. The number two person at OpenAI went on a TED Talk earlier this year
and was telling stories of how ChatGPT has helped people. And he told a story about a guy who had a
dog that was sick and the guy couldn't afford a vet. So he used ChatGPT to diagnose it and was
literally able to save the dog's life. The number two person at OpenAI told that at a TED Talk
earlier this year. And now they're removing functionality like that. Right? And you see people
that were like, couldn't afford a therapist, that were using ChatGPT. And in their opinion,
really getting real benefit from it. You can't do that anymore. Right? And so, yeah, it really
has shifted. I made that statement last week in Austin and I had someone come up to me after my
talk. And I won't say who he is and I won't say what company he works for, but it's one of the
big ones in this space and he's like, you're absolutely right. He said, I'm in meetings
basically daily with that team and 90% of what we talk about is limiting liability. I get it.
I hate it. I absolutely hate it. Right? I want the functionality, but I get it.
But what is that going to do? That's just going to force us, right? Once we have these more
unrestricted models, as people start to basically have this capability with no restrictions
whatsoever, that's just YOLO. We're all going to switch to that. I mean, we just really,
truly are, right? And so it's weird. Sometimes I just want to grab a bucket of popcorn
and I'm being perfectly honest, a lot of whiskey.
Those of you that know me know that. And just kind of sit back and see how it goes. Because
I'm going to be fascinated to see how it plays out. Because like I said, all the major players
in this space focusing on limiting liability, that's not going to play well long-term with
the consumer. It's just absolutely not. So we'll see. We'll see where it goes. And I was like,
I just asked mid-journey for a race pick last night and it gave me this and I'm like,
well, that's going in the talk. The rabbit has no meaning. I just like the rabbit.
Let's look a little bit at code analysis, right? As far as things that we can do for
reconnaissance a few different ways. One thing that I do in my SANS class is I always stay
late on day one and try to help out people who have never used Linux before to get a little
bit more familiar with it. And a lot of people have like want to get better with Linux, right?
And OSINT, that's kind of one of the things, usually the two things that people really
want to focus on when they're getting started in the space. I want to get more comfortable
with Linux and I want to get more comfortable with Python, right? Or programming. If you want
to learn programming in some other language, switch to Python. Unless you're trying to bypass
A, B. No one here is, probably. But then you always have these people that give you horrible
advice. Like, really, why should I use Linux? Because then you can customize it like bro.
They're just trying to get started with the command line. You want to start making kernel
modifications? Like, calm down. Let's be a little bit realistic right here. I think that advice,
honestly, on why you should learn these things is sometimes disingenuous. Analyzing source code
isn't always easy. And this right now, once again, large language models are made to order
for this. There are some problems that these just eviscerate, right? I had some Python code for a
project on GitHub. I tried to give chat GPT. Chat GPT doesn't take a whole lot of information right
now. There's a very limited amount of tokens that you can only give it so much text to ask a
question. Google BARD has a much higher limit, right? I think most of us in here use Google as
our default search engine. Some use DuckDuckGo, some use other. It sounds weird. Hey, John,
just Google it. He's like, okay. If I said, hey, Zobin, just Bing it. Half of us would win,
half of us would last. It's a good search engine. It is, right? And let's be honest,
it has a lot of results in it that Google doesn't. There's a lot of content that maybe is a little
more shady, illegal that's in Bing that you won't find in Google. Not to get political or tinfoil
hattie, it just is. The same way a lot of people sleep on Bing do not sleep on Google BARD.
Google BARD when it first came out was getting laughed at. It has improved a lot, right? It
really has. And so here I took that GitHub code of a project and I gave it to Google BARD and asked
it to analyze the code and explain it to me. And it did it. And it did a really, really good job.
I was at a mixer last night with a bunch of cyber threat intelligence analysts sitting around.
And I had one guy who started talking to me and the subject of like AI came up.
And right now he's taking a lot of advanced math classes, right? Working on crypto.
And he said there was one problem that he did not understand and his professor could not explain it
to him. He took that problem to ChatGPT and it gave him a very clear concise explanation that
was accurate. That is insane, right? I had someone last week in Austin ask me if it's between ChatGPT
doing something for you and learning, which way should you go? Yes, right? Use ChatGPT to help you
learn. Don't just ask it to write the code. Ask it to explain it to you. You've got a Python project
you want to run, right? And once again, you always have those same people. Well, now you can look at
the code and understand what it's doing. Well, kind of, but that gets tough sometimes, right?
If you try to look at my code, you'll be able to understand it. No, because it's basically like
me building Lego blocks. It's pretty straightforward. You try to look at code
written by a professional developer. Nope. But here, it does an amazing job. And it's not just
about programs that you want to run to kind of get an assessment of what it does, how it works,
and if it's safe to run. But what about websites, right? What about analyzing JavaScript on websites
to see if it's tracking you? It's fantastic for that. So, if you ever look at JavaScript on
websites, it's not plain English, right? It's very, very obfuscated. They try to make it hard
to figure out what it's doing a lot of times on purpose. Here, once again, was a lot of JavaScript.
Why are you taking a screenshot of this? Come on, this is ugly JavaScript. I'm just kidding with
you. No, this was not the entire JavaScript. If I put the entire JavaScript on here, it probably
would have been about eight slides. Like, it was not a small function. I could probably figure that
out. I would not be sober by the end of it, so my results would slightly start to get worse and
worse, right? I've done this type of stuff before. I can do it. It kind of sucks, if I'm being honest.
I give this to ChatGPT. ChatGPT is like, that's way too much, dog. All right. I give it to Bard,
and Bard just does it. It sits there and explains what all the functions do.
And then at the very bottom, it actually gave me a link you'll see here in a little bit,
where it's like, hey, do you want all this in a table? Right? It's really, really kind of ridiculous.
But here, that JavaScript that was clearly tracking, designed to track website visitors,
it gives us a breakdown of exactly what it's tracking and exactly how it's doing it. Once
again, I could do this without it, but before I was finished, I might gouge my eyes out with
a rusty spoon. And so here, like I said, the code was clearly used for tracking visitors,
and there were some other sites, and I was trying to tell, is this the same entity? Is the same
entity that's tracking on this site also the one that's tracking on this site? Because at first
glance, the JavaScript looks roughly similar. I didn't even have to paste the JavaScript into
Bard, because what, two months ago now, more or less, ChatGPT killed the browsing functionality.
Bards is still alive and well. I gave Bard the link to those two JavaScript files on the two
different sites and asked it to compare the JavaScript to see how similar they were.
And here it is. It breaks down the key differences between the files, the way they handle errors,
the way they deal with variables, right? It gives the pros and the cons. It breaks down
the styles being different. The second library is more object-oriented, robust, and portable.
And then at the very bottom, thank you, here's a table that summarizes the key differences between
the two libraries. And it gives it to me in a table with a little button to export it out to
Sheets. Anyone who's done this manually, like seriously, right? This is the way. This is like
I said, oh, these things, they hallucinate. You can't use these, really. Because in ways like
this, this is it, right? This is absolutely it. My time is almost up, so let's talk about report
writing really quickly. Everyone's absolute favorite thing, right? And I used to tell my
analyst all the time, you can spend a week doing things that are clever and very, very impressive.
You're not being judged on any of it, right? The only thing you're being judged on
is what goes in that email that you push send on. So make it good.
Let's see how large language models can help us. First things first, right? You try to ask
chat GPT to write something for you, a lot of times it comes up with some good stuff, but it's
not nearly good enough to copy paste, right? You just basically, how I've been using it a lot of
times up until recently was asking it for a lot of ideas and then picking and choosing, mixing and
matching, copying and pasting, right? It is good with writer block. Let's look at a few things that
can help us though when it comes time to report writing. Number one is very simple. Identify a
writing sample that you think represents you well, right? It has your tone, it has the way you explain
things. Take that writing sample, save it in a text file. My buddy Josh has his saved in Obsidian
in there because that's where he's organizing everything. And every time he goes to ask chat GPT
to write something, he first gives it that writing sample. I'm getting ready to ask you to do
something. I want you to write it in this style. And it's just a copy and paste from, like I said,
a text file, Obsidian, wherever you want. And then you watch, watch how much better the output is.
It is dramatically better and it's in your style, right? So things that are your style, you just
tend to like more anyway. And for the final thing here, chat GPT isn't great at turning a six-word
prompt. Everyone's like chat GPT is getting dumber. You gave it six words and asked it to write your
thesis. Stop, right? It's not good at taking six words and turning that into some masterpiece.
But if you gave it a thousand words right now, now it's going to do good. But the problem is
I don't want to type that. Ain't no one got time for all that, right? So what we can do now is start
to combine some of these things. Record yourself explaining what you want. You can use an app on
your phone. You can use Whisper. I don't care what you use. Transcribe what you just explained into
text. Now give that text to chat GPT or BARD and now ask it to write what you want, be it a report
or something else. How many times do you go to send an email to a friend and you realize there's
no way I'm going to send this email. I'm just going to call them because this is going to take me 15
minutes to write the email or it's going to take me two minutes to explain on the phone. Why do we
think it would be any different with chat GPT, right? So if we can harness that, if we can take
our voice and explain what we want. I almost feel like I'm talking to a toddler, right? Use your words
and then ask it. Once again, a lot better results. So there's a lot of different ways we've talked
about here, right? Transcribing, translating, summarizes. And once again, as far as how we're
going to use this, it's on us. It's on the people that are in this room. It's on the people that are
watching online to think of how we can use this technology for good, right? If you want to get a
hold of me, I am the easiest person in the world to get a hold of, right? I shouldn't even insult
you. This is Reconnaissance Village. I am Matt0177 on what used to be Twitter, now X, whatever you
want, right? Matt at ArgeliusLabs.com. If you want to hang out and talk OSINT, I put some stickers on
a table over there. I don't know if they're still there. They're already gone. But we have a lot more
stickers. We have challenge coins. The room wasn't ready yet, but we're actually going to post up at
the hospitality suite at the top of the horseshoe. And I have stickers. I have coins. If you want to
hang out and talk OSINT, talk about the SANS class, whatever, let me know. And also, there's no way I
have a hospitality suite that is not fully stocked with alcohol. And when I say a case of bourbon,
I mean a case of bourbon. So like I said, I'm easy to get a hold of. If you want to hit me up,
hit me up. Slide into my DMs and let's chat. So thank you all for your time. I appreciate it.