WEBVTT 00:04.120 --> 00:05.540 Hi, everyone. 00:06.740 --> 00:08.160 Good morning. 00:10.360 --> 00:12.540 That's the kind of cheer we need. 00:12.580 --> 00:18.920 So thank you so much for coming to our DEF CON this year, Recon Village. 00:18.920 --> 00:22.180 So let's give a big round of applause for Recon Village. 00:28.100 --> 00:30.040 So happy to see so many people. 00:30.040 --> 00:33.860 It's like the room full and I can see some people standing out there as well. 00:33.960 --> 00:43.060 We're going to be introducing our first speaker, our keynote speaker, who's going to be talking about something very interesting, something very hot right now. 00:43.060 --> 00:45.380 So who all have heard about AI? 00:45.820 --> 00:46.960 No? 00:47.360 --> 00:48.080 No? 00:48.080 --> 00:48.820 No? 00:48.820 --> 00:49.580 Yes? 00:49.580 --> 00:50.480 Maybe? 00:50.480 --> 00:57.140 So he's going to be speaking about reshaping reconnaissance, AI's role in open source intelligence. 00:57.140 --> 01:00.340 So let's welcome Matt Edmondson. 01:00.340 --> 01:15.960 And he's actually founder for Argilius Labs, hacker, forensicator, science author, practical open source intelligence course, principal instructor, Black Hat speaker, OSCP holder, featured in Wired, and so many more things to say about him. 01:15.960 --> 01:22.440 But what I'm going to do is... I'm going to shut my mouth now and I'll give the stage to him. 01:22.440 --> 01:24.500 But let's give him a round of applause. 01:30.900 --> 01:34.480 I met her half an hour ago and I'm already deeply afraid of her. 01:36.040 --> 01:41.320 Also, the hardest part of this talk is going to be not moving for an hour with the stationary mic. 01:41.320 --> 01:42.920 I literally might explode. 01:42.920 --> 01:45.160 So she did a good job introducing me. 01:45.380 --> 01:49.460 Almost 22 years as a federal agent, started up a lot of OSINT units with the government. 01:50.020 --> 01:50.740 Louder? 01:50.740 --> 01:51.600 All right. 01:51.600 --> 01:52.180 All right. 01:52.180 --> 01:54.980 I got to get real close and intimate with this microphone. 01:54.980 --> 01:56.180 Thank you for letting me know. 01:56.180 --> 02:02.080 I'm the author of the SANS SEC 497 practical OSINT course, Black Hat speaker, featured in Wired, et cetera, et cetera. 02:02.360 --> 02:03.840 What are we going to talk about today? 02:03.840 --> 02:05.160 A little bit of introduction. 02:05.460 --> 02:10.100 We'll talk about using AIML for profile creation, see what that looks like real quick. 02:10.100 --> 02:16.300 For processing, which I think is honestly what we'll probably end up spending most of our time, kind of processing, massaging data. 02:16.700 --> 02:20.000 Code analysis and end it with a little bit of report writing. 02:22.120 --> 02:23.500 It's kind of weird. 02:23.620 --> 02:32.220 If we're being perfectly honest, if we gave this talk a year ago, like these would just be buzzwords, right? 02:32.400 --> 02:34.240 I mean, seriously, for most of us in here. 02:34.380 --> 02:35.040 AIML. 02:35.040 --> 02:38.540 I think I joked when I was speaking at the 2021 SANS Summit. 02:38.680 --> 02:40.620 I wrote a persistent monitoring tool. 02:41.060 --> 02:46.160 And I said, yeah, if I was trying to get funding, if I was trying to sell it, I would say it uses AIML. 02:46.160 --> 02:49.580 It's just lists and common sense and some shoddy Python code. 02:49.720 --> 02:50.900 Really it is. 02:50.900 --> 02:57.740 And all of a sudden a year later, we actually have usable things that do produce some amazing, amazing capabilities, right? 02:58.280 --> 03:02.620 And you're already starting to see some people think that this is just a fad. 03:02.640 --> 03:04.840 We live in an industry full of fads, right? 03:04.840 --> 03:06.160 Next generation this. 03:06.160 --> 03:08.640 There's always some new next thing that's going to be the savior. 03:08.640 --> 03:11.060 It never actually pans out. 03:11.200 --> 03:16.120 And so it's very, very easy to think that it's going to be the same way with some of these capabilities. 03:16.120 --> 03:18.940 But I really don't think that's going to be the case at all. 03:18.940 --> 03:20.460 I really, really don't. 03:21.340 --> 03:27.320 I originally started playing with this tech late last year, like I think a lot of us probably did. 03:27.660 --> 03:31.140 And I was in curiosity and I just started using it more and more. 03:31.140 --> 03:32.880 I was amazed by the results. 03:33.120 --> 03:36.000 And usually how I was using it was to help me writing code, right? 03:36.000 --> 03:37.560 I'm not a professional programmer. 03:37.560 --> 03:43.600 I can write shoddy Python code that helps me, my friends, my teammates and kind of gets the job done. 03:43.600 --> 03:47.440 And all of a sudden with ChatGPT, I was writing that code a lot quicker, right? 03:47.440 --> 03:49.540 I was just really, really enjoying it. 03:49.560 --> 03:56.540 And I saw someone on an OSINT Discord say, yeah, ChatGPT, it's neat, but it's not really useful for OSINT. 03:56.540 --> 03:59.320 And I'm like, man, I'm using it every day, right? 03:59.320 --> 04:03.420 And so that's when I decided to do a webinar on how ChatGPT for OSINT. 04:03.480 --> 04:07.680 And when I did it, I didn't just want to talk about how I was using it. 04:07.680 --> 04:15.080 And so I actually forced myself to sit there and think, how could we use it in every phase of the intelligence cycle? 04:15.100 --> 04:19.760 And as I started playing with it more and more, frankly, I was more and more amazed. 04:19.760 --> 04:22.180 I just really, really truly was. 04:22.980 --> 04:30.360 The good news is the hard stuff is getting more and more unnecessary every day, right? 04:30.360 --> 04:33.640 You don't really have to understand the math behind it. 04:33.640 --> 04:40.280 The same way if we're being honest at a hardware level, my phone does a lot of stuff that I don't understand exactly how it works. 04:40.300 --> 04:42.060 But I use it every single day. 04:42.060 --> 04:44.740 And this technology is quickly getting there, very quickly. 04:44.740 --> 04:48.020 If anyone's ever tried to play with the local models, right? 04:48.020 --> 04:50.800 Like Lama or some of those others. 04:50.840 --> 04:56.000 If we think back even four or five months ago, what do these things want you to do? 04:56.000 --> 04:57.420 Oh, download this. 04:57.620 --> 04:59.280 Download all these weights. 04:59.480 --> 05:00.420 Train the model. 05:00.420 --> 05:01.240 This is about it. 05:01.240 --> 05:02.240 You don't have to do that anymore. 05:02.240 --> 05:03.360 It's like one click. 05:03.840 --> 05:04.860 I mean, seriously, right? 05:04.860 --> 05:06.300 It's like a pip install. 05:06.300 --> 05:07.620 And then you have things running. 05:07.620 --> 05:08.760 And it's just going there. 05:08.760 --> 05:09.540 And I like that. 05:09.680 --> 05:12.220 And it's not just installing and using local. 05:12.220 --> 05:14.100 I think it's kind of everything in this space. 05:14.100 --> 05:15.620 Right now for 2023, right? 05:15.620 --> 05:17.640 One of the hot jobs has been prompt engineering. 05:17.660 --> 05:23.860 It's getting very, very good at asking these models questions and getting the results you want. 05:23.900 --> 05:26.640 That's not going to be a job in like two years for the most part. 05:26.640 --> 05:27.700 It's really, really not. 05:27.700 --> 05:31.060 Because they're getting better and better at knowing what they want, right? 05:31.060 --> 05:34.380 When I was a little kid, I tried to draw. 05:34.380 --> 05:35.860 I can't draw, right? 05:35.860 --> 05:37.900 I can't draw a straight line with a ruler. 05:37.900 --> 05:38.820 I'm horrible. 05:39.320 --> 05:43.140 But now, like if you look at all these graphics, I made them myself using my words, right? 05:43.140 --> 05:44.300 Using mid journey. 05:44.600 --> 05:49.660 And you used to have to give mid journey like these long, complicated commands to try to get decent output. 05:49.980 --> 05:52.660 Nowadays you can give it two words and get pictures like this, right? 05:52.660 --> 05:54.380 So it's heading in the right direction. 05:54.380 --> 05:56.020 And I'm very happy to see it. 05:56.840 --> 06:01.080 It's going to change the way that a lot of things are getting done, frankly. 06:01.080 --> 06:02.280 It just is, right? 06:02.280 --> 06:07.060 And it's going to be important to be at least familiar and comfortable with it. 06:07.120 --> 06:09.760 There's someone named Daniel Missler who's brilliant. 06:09.760 --> 06:13.060 He comes out with a newsletter each week on kind of trends in technology. 06:13.060 --> 06:15.180 If you like his stuff, you should definitely check it out. 06:15.540 --> 06:19.260 But he's mentioned a few times something called like a K-shaped recovery, right? 06:19.260 --> 06:31.420 And as we start to think of what this is going to change and how it's going to affect our industry and how it's going to affect our jobs, it kind of makes sense that it's probably going to be very, very good for some people and very, very bad for some people, 06:31.420 --> 06:31.680 right? 06:31.680 --> 06:34.140 If I was an artist right now, I would be terrified. 06:34.220 --> 06:37.520 And it sucks because I appreciate artists because I don't have that capability. 06:37.520 --> 06:39.780 So I can just sit there for hours and watch. 06:39.780 --> 06:43.260 Like I can go down to the strip and see someone with cans of spray paint making pictures. 06:43.260 --> 06:44.740 I can watch them for hours. 06:44.740 --> 06:47.420 I'm mesmerized because that's not a skill set I have. 06:47.620 --> 06:49.460 But now I'm making pictures like this, right? 06:49.460 --> 06:51.920 So like I said, if I was an artist, I'd be terrifying. 06:51.960 --> 06:56.420 And so what he means by a K-shaped recovery is just like a capital A, right? 06:56.440 --> 06:58.620 Are you utilizing AI ML? 07:00.260 --> 07:01.560 Probably going to be good for you. 07:01.560 --> 07:02.620 Are you not? 07:02.980 --> 07:04.320 It may not be the best. 07:04.320 --> 07:05.900 So it's just something to think about. 07:07.580 --> 07:10.440 And like I said, we live in an industry full of trends. 07:10.440 --> 07:16.240 I was a black hat yesterday and I saw a booth where they had like set up a coffin and candles saying something was dead. 07:16.240 --> 07:18.600 It was probably the tackiest booth I've ever seen in my life. 07:18.600 --> 07:20.380 If you work for that company, I apologize. 07:20.920 --> 07:31.300 But like I said, when we live in this industry, right, where there's so many things that are fads and trends, it's really not hyperbole to say that things that haven't been possible before now are. 07:31.520 --> 07:36.720 And it's kind of a silly example that I use, but the example that I love is sentiment, right? 07:36.720 --> 07:40.680 Has anyone in here ever tried in the past to do sentiment analysis at scale? 07:40.680 --> 07:43.160 It is a dumpster fire, right? 07:43.160 --> 07:46.240 Those of you that haven't tried, no, but it is a dumpster fire. 07:46.240 --> 07:47.020 It's one of those things. 07:47.020 --> 07:50.240 It's like three lines of Python to implement, right? 07:50.240 --> 07:52.560 Import text blob, get your score, you're good to go. 07:52.600 --> 07:55.680 But the score is iffy at best. 07:56.180 --> 07:59.060 And when I looked at this, this was, we used to have a site called Twitter. 07:59.060 --> 07:59.780 It was pretty cool. 07:59.780 --> 08:00.960 It's something else now. 08:00.980 --> 08:08.260 But when I was looking at a site to analyze sentiment, this was classified as the most negative tweet. 08:08.260 --> 08:10.380 And if you look at it, this is bad AF. 08:10.640 --> 08:12.040 Y'all killed it. 08:12.460 --> 08:14.220 That's clearly very positive, right? 08:14.220 --> 08:18.620 But everything that we throw it at says it's extremely negative. 08:19.360 --> 08:26.440 But now I just gave it to Google Bard, and Google Bard said it's positive and takes the time to sit there and explain why it's positive. 08:27.360 --> 08:29.340 We couldn't do this a year ago, right? 08:29.340 --> 08:30.480 At least not publicly. 08:30.480 --> 08:33.200 And so this is just one example of, like I said, it's not hyperbole. 08:33.200 --> 08:36.500 The things that weren't possible are now possible. 08:36.680 --> 08:41.100 And right now, like, honestly, this is kind of a good for demonstration operationally. 08:41.100 --> 08:41.460 What? 08:41.460 --> 08:43.580 I would want positive, negative, or mixed. 08:43.840 --> 08:44.860 But now think about that. 08:44.860 --> 08:48.360 When you're trying to set up persistent monitoring efforts, right? 08:48.360 --> 08:50.140 Why is sentiment so hard? 08:50.140 --> 08:51.620 Language changes, right? 08:51.620 --> 08:54.740 Bad is actually good now sometimes, depending on the context. 08:54.860 --> 08:55.400 Sarcasm. 08:55.400 --> 08:56.660 Hey, great job, Salvin. 08:56.660 --> 08:58.480 Real good to see you, right? 08:59.180 --> 09:04.260 These are the reasons why it's hard, but now these models are doing a really, really good job with it. 09:04.740 --> 09:11.240 Let's take a look at... we've got a couple of examples that I've shown before, and they're in here because they're really good, but then we have a lot of new stuff too. 09:11.340 --> 09:12.320 So one thing, right? 09:12.320 --> 09:16.260 How can we actually use this technology creating sock puppet accounts? 09:16.680 --> 09:22.700 And so here I asked chat GPT, can you give me 10 fake names for a French woman in her 30s? 09:22.700 --> 09:24.460 And it spits them out. 09:24.460 --> 09:27.480 I picked number five, Chantelle Rousseau. 09:28.120 --> 09:32.760 I then asked, can you recommend 10 usernames for a woman named Chantelle Rousseau? 09:32.760 --> 09:33.900 And it does it. 09:34.280 --> 09:36.740 This to me is hurts. 09:36.740 --> 09:38.660 This slide just hurts. 09:39.220 --> 09:46.740 Yeah, I'm tall and handsome and charming and modest, but honestly, clever, right? 09:46.860 --> 09:50.140 Clever is what's kind of gotten me along all these years. 09:50.140 --> 09:55.600 And now I look at the usernames that chat GPT came up with, and I'm like, dammit, chat GPT is more clever than me, right? 09:56.340 --> 10:00.840 Chantellicious, the Chantress, Chantelle C. 10:00.860 --> 10:02.140 Rousseau, Chante Rousse. 10:02.140 --> 10:07.280 These are like, there's like six names that I will freely admit are better than anything I could come up with. 10:07.720 --> 10:08.960 And that hurts. 10:08.960 --> 10:11.200 That's one less thing I got going for me, right? 10:11.920 --> 10:21.520 And now that we have the name, and now that we have the username, and I know this went to small, I apologize, but I say, can you please fill out all the profile information? 10:21.560 --> 10:29.560 And it gives me a date of birth, a city, her interests, and then a short bio right in there, right? 10:29.560 --> 10:32.300 It really, really kind of is crazy. 10:32.460 --> 10:36.920 And so this is push-button automated now to just come up with an accurate, right? 10:36.920 --> 10:40.100 And I've showed this to people from France, and they're like, no, that looks spot on. 10:40.600 --> 10:42.800 This is push-button capability. 10:42.960 --> 10:44.880 But what about the profile pictures, right? 10:44.880 --> 10:49.400 We have these things now to detect that a picture isn't real. 10:49.880 --> 11:02.620 Except most of the tech that's detecting if a picture isn't real, they don't know what everyone in the world looks like, and long story short, GAN stands for a generative adversarial network. 11:02.740 --> 11:08.440 And this was some researchers at NVIDIA, the company that their stock is skyrocketing right now, right, because of this stuff. 11:08.440 --> 11:13.660 But they make graphics cards, and their researchers had to come up with an algorithm to detect faces. 11:13.660 --> 11:18.180 And so they made an algorithm to create faces, and basically generative adversarial network. 11:18.180 --> 11:25.200 Generative because it actually makes something, and adversarial network because you have two computer programs that you're battling against each other. 11:25.200 --> 11:41.320 And so, for instance, if we make a program that makes counterfeit currency, and another program that detects counterfeit currency, and we battle them together thousands, millions of times, what's eventually going to happen is the counterfeiter is going to get so good that it's almost never going to get detected, 11:41.320 --> 11:41.500 right? 11:41.500 --> 11:45.240 And so they came up with this algorithm to make faces, but there are tells, right? 11:45.240 --> 11:56.100 The most common one is, if you've ever played with that site, this person does not exist, and you take your fingers, and you cover eyes, and you hit refresh, refresh, refresh, all these new faces, right? 11:56.100 --> 11:57.160 Your fingers never move. 11:57.160 --> 11:58.320 You're still covering the eyes. 11:58.320 --> 11:59.860 That's kind of its north star. 12:00.440 --> 12:08.820 And so a lot of these tools, a lot of these plugins, etc, oh, we detect fake faces with a 99.82% accuracy. 12:08.860 --> 12:09.980 No, you don't. 12:10.140 --> 12:12.900 You detect if it was generated with a GAN, right? 12:13.060 --> 12:19.760 And so a lot of people are familiar with ChatGPT, obviously, but a lot of people haven't ever played around on a site called Hugging Face. 12:20.000 --> 12:25.940 You ever have like a friend that always likes to brag that they were on a band before anyone else, right? 12:25.940 --> 12:29.500 I was watching Green Day back when they were playing in bars in Hemet, right? 12:29.840 --> 12:35.660 If you want to be that person in the AI ML space, and who doesn't, Hugging Face is where you should be playing out. 12:35.660 --> 12:42.380 It's a lot like GitHub, except they actually let you set up spaces where you can test and play with these codes. 12:42.800 --> 12:47.600 And one of the code out there right now is a project called Face Swap, and Face Swap is pretty cool. 12:47.600 --> 12:55.380 It lets me take a picture of myself, mix in that bottom person at the left, the far less handsome person in the lower left corner. 12:55.440 --> 12:57.820 That's actually a GAN generated image, right? 12:57.820 --> 13:00.380 You can tell with the soulless little eyes there. 13:00.620 --> 13:05.700 And it lets me now mix in elements from that GAN onto my picture. 13:05.700 --> 13:15.580 So even though I kind of mixed in attributes from a GAN, if you look at my picture, it still has the same basic shape, the same basic, right, kind of angle. 13:15.580 --> 13:18.000 The eyes aren't in the exact same spot. 13:18.000 --> 13:25.340 And so all these tools that brag that they have a 99.82% accuracy, this is just a rip in the right biome, right? 13:25.340 --> 13:35.500 And so literally right now, we have the capability with an API to generate profiles and generate profile pictures in seconds, right? 13:35.500 --> 13:39.120 And for those of us that have to create accounts at scale, this is glorious. 13:39.120 --> 13:46.400 For those of us that are trying to deal with propaganda networks, right, and the things that a lot of us are dealing with, this is terrifying, right? 13:46.400 --> 13:48.600 That is absolutely the scary part. 13:48.680 --> 13:58.740 And right now, I don't honestly have a lot of answers, but I think those of us in this room and those of us at home, we're going to be on the hook to solve this problem, right? 13:58.760 --> 14:03.480 We're using these capabilities to generate these things at scale. 14:03.520 --> 14:07.720 We're going to have to figure out ways that we can use these capabilities to detect them at scale, right? 14:07.720 --> 14:08.480 And we can. 14:08.480 --> 14:12.180 And like everything else, this is going to turn into a cat and mouse game, right? 14:12.180 --> 14:14.620 This AIML, it's like, what is it going to be good at? 14:14.740 --> 14:16.540 Yes, right? 14:16.700 --> 14:18.080 Seriously, yes. 14:18.080 --> 14:23.640 We just have to get clever and creative about how we're going to use it and how we're going to deploy it. 14:24.800 --> 14:27.360 Let's talk for a little bit about processing. 14:28.580 --> 14:34.400 Throughout my entire career with the government, I would hear people say collection and analysis, right? 14:34.400 --> 14:38.580 And I think if any of you were in the Gubby space, you always hear collection analysis, collection analysis. 14:39.320 --> 14:41.380 You're missing a step, right? 14:41.380 --> 14:48.520 There's a step in between there, and that step is honestly where I lived most of my career, and that step is processing. 14:48.720 --> 14:55.600 Processing is taking the data and actually putting it in a format where it's suitable to be analyzed, right? 14:55.660 --> 15:00.940 I always joke, like, everyone says they want all the data until you give them all the data, right? 15:00.940 --> 15:10.740 Seriously, people are like, I want all the data, and you hand them like a 16 gigabyte SQL database of breach data, and they're just staring at it like a hog looking at a wristwatch, right? 15:10.740 --> 15:12.700 No idea what's going on. 15:12.700 --> 15:18.400 And it's actually being able to process that data, massage that, and put that in a format where people can analyze it. 15:18.400 --> 15:21.280 It could be something like just translating it to a native language, right? 15:21.280 --> 15:25.420 To a language that you speak, or whatever it is, but processing. 15:25.560 --> 15:35.500 It's a critical step, like I said, because of my technical skills, most of my career, this is where I lived, is kind of taking these things that people didn't know how to deal with and making it to where they could deal with it. 15:35.600 --> 15:41.840 And I got to tell you, this tech is absolutely ridiculous at doing these things. 15:42.920 --> 15:48.060 Another example that I've used, but it's just too perfect not to use, Conti, right? 15:48.060 --> 15:49.040 A lot of us have heard of that. 15:49.120 --> 15:52.760 Ransomware gang, been observed since 2020, 2022, right? 15:52.760 --> 15:56.560 Last year, the government offered a reward of 10 million, I'd like 10 million dollars. 15:57.520 --> 15:58.520 Conti came out, right? 15:58.520 --> 16:02.420 If you're like a threat actor operating in Russia, right? 16:02.420 --> 16:03.180 What are the rules, right? 16:03.180 --> 16:05.520 You really, for the most part, don't mess with other Russians, right? 16:05.520 --> 16:11.540 That's where the malware tries to detect the language, and if Russia asks you to do something, you do it, right? 16:11.540 --> 16:13.180 That's kind of the rules. 16:13.940 --> 16:18.400 And so obviously, Conti came out and expressed support for the invasion of Ukraine. 16:18.400 --> 16:25.720 Well, not everyone in the group was on board, and so someone leaked 60,000 messages from their internal chat. 16:25.860 --> 16:29.560 This sounds amazing, this is like beautiful, let's read them. 16:29.680 --> 16:31.220 Cool, here they are. 16:32.080 --> 16:35.900 Once again, the font is small, I know, but number one, they're in JSON. 16:35.920 --> 16:40.540 All right, the, you know, the addresses are a little weird, right? 16:40.540 --> 16:45.540 They end in a dot onion, got some dark web stuff going on here, and the body, the text, right? 16:45.540 --> 16:47.060 It's all in Russian, right? 16:47.060 --> 16:48.680 It's all in Cyrillic, it's all in Russian. 16:48.800 --> 16:50.820 We can do this, right? 16:50.820 --> 16:56.860 We have translate, we have human translators, we have tech translator, translation engines are getting good, right? 16:57.000 --> 17:00.460 Translations are way better than a lot of people think right now. 17:00.600 --> 17:04.100 We can make this happen, but it's going to be a little bit of a pain in the butt, right? 17:04.100 --> 17:06.500 60,000 messages, grab a Snickers. 17:07.880 --> 17:15.300 Here, I give the text to chat GPT and I say, parse the body field in the JSON and tell me what the conversations are about. 17:16.740 --> 17:18.660 It cannot be this easy. 17:19.380 --> 17:21.040 Damn it, it's this easy. 17:22.420 --> 17:24.080 Seriously, look at that. 17:24.340 --> 17:35.240 This person and this person having a conversation about registering an external account for backup purposes, these ones talking about their location, providing login details for several servers. 17:36.460 --> 17:39.120 I didn't have to massage the JSON. 17:39.780 --> 17:44.100 I didn't have to translate the Russian to English so I could understand it. 17:44.100 --> 17:46.120 I didn't have to do any of that. 17:46.120 --> 17:49.300 It just did it, right? 17:49.300 --> 18:01.360 Like I said, it's to say that this is a fad, I think is crazy personally, because all of a sudden, things that just were not possible at scale before now are. 18:03.060 --> 18:08.140 And this is one thing, too, where it gets a little tricky, right? 18:08.140 --> 18:19.040 I was just, two weeks ago, I was teaching at a conference in New York and all of the people for the conference were setting up, well, there were some union workers that were just standing around watching, right? 18:19.040 --> 18:19.900 But they were getting paid. 18:19.900 --> 18:21.640 You had to have the union workers there, right? 18:21.640 --> 18:24.480 And that's just, you know, there are some cities that are like that. 18:24.480 --> 18:30.340 I'm not saying it's good or bad, but it's this, well, it's taking someone's job, right? 18:30.340 --> 18:31.520 Like, no, you can't do that. 18:31.520 --> 18:33.400 I need to do that, because that's someone else's job, right? 18:33.400 --> 18:34.100 I can't do that. 18:34.100 --> 18:35.240 That's someone else's. 18:36.180 --> 18:38.600 And so it's easy to think this and get afraid. 18:38.600 --> 18:41.540 Like I said, if I was an artist, I'm going to be honest, I'd be terrified. 18:41.820 --> 18:44.640 But this tech isn't about replacing people. 18:44.920 --> 18:47.820 It's about toll reduction, right? 18:47.840 --> 19:01.300 It's about taking the things that a human being doesn't like and automating that and letting them focus on what we're good at, because there are some things that humans are absolutely better at than this tech, especially right now. 19:01.300 --> 19:14.680 But if we can use it so we can focus our time, I always think back to when I first ever used Python, it was actually for GIS work, and I had one of my Intel analysts who every week had to generate a report . 19:14.680 --> 19:25.600 She had to analyze certain activities that occurred in different regions and actually come up with some stats for that, and this literally took her an entire day every week. 19:25.980 --> 19:30.300 And I'm like, there's got to be a way to automate this, right, with some of these capabilities from Esri. 19:30.300 --> 19:31.560 And I reached out to the company. 19:31.560 --> 19:35.560 I'm like, hey, is it possible to use these tools externally and just tap the Python API? 19:35.560 --> 19:36.900 And they're like, I don't know. 19:36.960 --> 19:38.160 No one's ever asked me that. 19:38.160 --> 19:38.780 Cool. 19:39.300 --> 19:50.660 Took me about two days, but I was able to cobble together some code and automate that and take something that was literally taking her a full day every week and made a push button run in about ten minutes, right? 19:50.660 --> 19:52.500 She wasn't out of a job. 19:52.940 --> 19:54.880 We didn't convert her to part-time. 19:55.380 --> 20:03.360 It let her get rid of something that she hated doing every week and focus on things that she was actually good at and enjoyed a little bit more, right? 20:03.360 --> 20:08.220 So that's definitely the mindset that I try to keep in mind as I think about how to use this. 20:08.220 --> 20:14.680 Like I said, I really think it's about toll reduction, not about replacement, at least for right now and hopefully forever. 20:15.740 --> 20:21.080 I personally, you see all these cool little parlor tricks that people are doing. 20:21.180 --> 20:33.560 I think the killer app right now for these large language models like ChatGPT and Google BARD, and we'll talk more about BARD later, I really think that the killer app is summarization, right? 20:33.560 --> 20:38.140 I give you just a mountain of text and you summarize it for me, right? 20:38.140 --> 20:40.800 Just like those conversations we just looked at. 20:41.720 --> 20:46.700 We saw the power now of taking text, but what about other stuff, right? 20:46.700 --> 20:48.340 What about audio and video? 20:48.460 --> 20:50.320 And for that, let's look at something called a Whisper. 20:50.320 --> 20:53.120 If you've never seen Whisper before, you are in for a treat. 20:53.120 --> 20:58.600 Whisper is ridiculous and it's got everything going for it and it is completely free. 20:58.600 --> 21:02.160 It's made by OpenAI, the same company that makes ChatGPT. 21:02.460 --> 21:09.160 And there's a lot of times for a lot of reasons where you have audio and video files that you actually need to transcribe, right? 21:09.160 --> 21:11.300 We need text from this. 21:11.820 --> 21:13.880 Whisper automates that task. 21:13.980 --> 21:21.740 Here, I took a video from my personal trainer on how to, kind of advice on how to meet your protein goals, and I sicked Whisper on it. 21:21.740 --> 21:24.300 Whisper is two lines to install. 21:24.380 --> 21:31.500 You have to install a FFmpeg, like an open source audio video processor, and then it's just a pip install Whisper. 21:31.500 --> 21:33.220 It is seriously that easy. 21:33.340 --> 21:36.440 Once you do that here, you see I say Whisper. 21:36.640 --> 21:38.080 I give it the name of the video. 21:38.120 --> 21:45.800 It takes about 30 seconds of audio to analyze the language and detect it, and then it just starts spitting out. 21:45.800 --> 21:47.720 The blur there is he dropped an F-bomb, right? 21:47.720 --> 21:49.300 I didn't want an F-bomb in my talk. 21:49.300 --> 21:51.920 If I'm going to drop an F-bomb, it's going to be me, not a text. 21:52.420 --> 21:54.380 And I'll try not to, I promise. 21:54.640 --> 21:58.320 But no, I mean, if we're looking at that, it's spot on, right? 21:58.320 --> 22:02.960 And he's got a fairly thick Irish accent, but he's easy to understand. 22:02.960 --> 22:07.080 So this is impressive, but it's easy to understand, and it's in English. 22:11.400 --> 22:13.460 What other languages does it support? 22:13.540 --> 22:15.020 Yes, right? 22:15.920 --> 22:21.600 And like I said, I know this font is small, but that's a lot of languages right there. 22:21.600 --> 22:23.800 Some are going to be better than others, right? 22:23.800 --> 22:30.800 It's going to have better support for English, the popular languages, German, French, Russian, than it will for some of the more obscure ones, I'm sure, there. 22:30.800 --> 22:33.880 But still, that is a ridiculous level of support. 22:35.060 --> 22:36.160 So I gave it English. 22:36.160 --> 22:42.760 It did good, but how would it do with a foreign language and one that's not the easiest to understand there, right? 22:42.760 --> 22:44.480 So Juan Huyabora, a.k.a. 22:44.560 --> 22:45.760 Spanish Laughing Man. 22:45.820 --> 22:48.260 A lot of us have probably seen his meme videos, right? 22:48.260 --> 22:50.780 The AWS Exhibimon is just the GOAT. 22:50.780 --> 22:52.820 I've watched that probably 20 times. 22:53.560 --> 22:55.600 So let's see how it does with him. 22:55.600 --> 22:59.200 First things first, it actually detects the language slightly off, right? 22:59.200 --> 23:07.280 After 30 seconds, it detects it as Galician, like a mix of Spanish and Portuguese, which from Spain, like, this actually kind of makes sense. 23:07.500 --> 23:14.240 And so here I aborted, just control seat out, and I did it again, but I actually forced Spanish. 23:14.240 --> 23:21.420 So you see their language ES, and it starts having no problem transcribing what is being said in the video. 23:22.980 --> 23:24.180 And guess what? 23:24.180 --> 23:31.540 I can also do tac-tac translate, and now instead of just transcribing, it also translates to English. 23:32.300 --> 23:34.420 We've seen what it does. 23:36.060 --> 23:38.580 We've seen the languages it supports. 23:39.400 --> 23:44.180 Would you believe me if I told you that this capability was all offline? 23:44.920 --> 23:46.480 Because it is. 23:47.240 --> 23:48.680 Because it is. 23:48.680 --> 23:52.780 I wrote up a blog post on this, and someone's like, there's no way that's offline. 23:52.780 --> 23:54.040 I'm like, let's test it. 23:54.160 --> 24:05.400 So I fired up a cheap little nook, put Ubuntu on it, I installed Whisper, and I ran it one time, because the first time you run it, it downloads one of the models. 24:05.400 --> 24:07.780 It downloads the medium model by default. 24:07.780 --> 24:10.440 I think it was 461 megs. 24:10.440 --> 24:12.920 It took, like, three seconds to download, seriously. 24:13.820 --> 24:24.120 Once it downloaded, and it ran one time, I stopped it, I disconnected the network cable, showing the device was not hooked up to the internet in any way, shape, or form. 24:24.300 --> 24:28.400 I then tried a different video, and it crushed it. 24:28.480 --> 24:30.380 Once again, that was in English. 24:30.380 --> 24:31.140 Cool. 24:31.880 --> 24:37.980 Let's try a Spanish one, giving it the task to translate, and it does that. 24:38.640 --> 24:49.740 Locally, we are taking massive amounts of audio, video, whatever we want, sucking the text out of it, and even translating it with no internet connectivity. 24:49.920 --> 25:03.820 And once again, if you've ever tried to do things like this at scale, and you see the quality of the output that it's producing, it's, like I said, to say it's revolutionary, I think, is even an understatement at some points, right? 25:03.820 --> 25:04.940 And this is it, too. 25:04.940 --> 25:13.680 It's an important thing to think about, and we're going to talk about it here in a little bit, but we're at the very early phases of this technology, right? 25:13.680 --> 25:20.960 People like to point out flaws, go down to a car museum, and look at a Model T. 25:21.400 --> 25:22.820 That's a cool car. 25:23.180 --> 25:27.360 Would anyone here want to use that as a daily driver if you couldn't sell it and had to use it? 25:27.360 --> 25:29.880 That would be your worst life choice ever, right? 25:29.880 --> 25:34.080 What we're playing with right now is the Model T of this tech. 25:34.480 --> 25:36.060 It really, really is, right? 25:36.060 --> 25:43.340 And think of how far we've come, and how fast we've come, and I have no reason to believe that this is going to be any different. 25:45.560 --> 25:47.880 Nothing is perfect, right? 25:48.060 --> 25:52.060 Sometimes these large language models make things up. 25:52.720 --> 25:58.880 I was talking to a buddy of mine, a fellow SANS instructor, Mick Douglas, about hallucinations. 25:58.880 --> 25:59.940 That's the term for it, right? 25:59.940 --> 26:03.020 When these large language models just make stuff up, hallucinations. 26:03.020 --> 26:10.240 He was having ChatGPT write some .NET code for him, and he's like, man, this code is clean, this code is beautiful. 26:10.240 --> 26:12.520 I didn't even know that function existed. 26:12.820 --> 26:14.140 It didn't. 26:18.780 --> 26:20.860 That wasn't the worst one. 26:21.660 --> 26:24.780 ChatGPT is actually really good at commenting code, right? 26:24.780 --> 26:32.560 If you try to use ChatGPT to crank out some code, it's pretty good about commenting it and about letting you know what it's doing, which, from a learning perspective, is fantastic. 26:34.020 --> 26:45.220 He asked it to write some code, and in the comments, it said, yeah, this, you know, right here, what this is doing, this is actually referenced in this blog post, and it gave a link to the blog post in the comments. 26:45.220 --> 26:47.520 He's like, this is so cool. 26:47.620 --> 26:49.500 He went to read the blog post. 26:49.520 --> 26:51.220 It didn't exist. 26:52.180 --> 26:59.980 And he could find, and this is not a dumb person, he couldn't find any evidence the blog ever existed. 27:00.400 --> 27:02.760 It wasn't he couldn't find the blog post. 27:02.900 --> 27:05.520 He doesn't think the blog ever existed. 27:06.700 --> 27:08.920 And you hear stories like that. 27:09.860 --> 27:15.040 And it's very, very easy to say that this tech is not ready for primetime, that this is a parlor trick, right? 27:15.040 --> 27:21.840 This is just another in a long line of fads in this industry, so let's just pour a drink and go on to the next one and get it over with. 27:22.440 --> 27:25.120 But I really don't think that's the case. 27:25.480 --> 27:32.980 And in this case, I think if we just abandon this, and we decide that it's not perfect, so we don't want to use it, we're making a horrible mistake. 27:32.980 --> 27:35.180 We're throwing the baby out with the bathwater, right? 27:35.180 --> 27:40.840 Goes all the way back to Voltaire, who said, do not let perfect be the enemy of good, right? 27:40.840 --> 27:43.420 That is a very important concept in so many things, right? 27:43.420 --> 27:48.000 I got John Hubbard here, good friend of mine, defense in depth, right? 27:48.000 --> 27:52.220 We don't rely on any one piece of technology to defend our networks, right? 27:52.220 --> 27:59.720 We have a collection of imperfect solutions that when used together leave us much better off than we were before. 28:00.060 --> 28:02.940 And so yeah, that does not mean they have no value. 28:02.980 --> 28:05.000 They absolutely do. 28:05.920 --> 28:10.060 I spent most of my career as a federal agent in intelligence, right? 28:10.060 --> 28:15.700 Because of my technical skills that I kind of developed, I got sucked into that very early. 28:16.240 --> 28:29.400 And good intelligence people, whether you're analysts, agents, whatever you are, but good intelligence people will always take what they're hearing, and they'll always go directly to the operators for ground truth, right? 28:29.400 --> 28:33.960 The actual boots on the ground, is this what you're seeing? 28:34.140 --> 28:36.300 Does this actually make sense? 28:36.300 --> 28:42.040 Sometimes they say yes, sometimes they say no, that's not what's going on, this is actually what's going on, and now you understand better. 28:42.280 --> 28:47.460 And the further you are from the action, the more important this is, right? 28:47.460 --> 28:48.040 Just 100%. 28:48.040 --> 29:02.860 I spent a few years in Washington DC working in some very cool places, but there you're removed from the front lines, you're removed from what's going on, and that's when it was so important to go to the actual operators and try to secure this ground truth. 29:04.200 --> 29:17.940 And so sometimes when I say where I think things are going, it's a prediction, and sometimes it's just wishful thinking, like I just watched some YouTube videos on meditation, I'm trying to wish this into existence. 29:18.260 --> 29:27.320 But this year, large language models like chat GPT, generative AIs like mid-journey, stable diffusion, that's been all the rage. 29:28.040 --> 29:34.300 What I really hope is that next year in 2024, one of the hottest terms we hear is grounding, right? 29:34.300 --> 29:47.760 And a lot of us probably haven't heard of that term yet, but it's basically taking the results from these large language models and running them through some known accurate data to double check, right? 29:47.760 --> 29:54.200 To really increase the confidence that we have in these findings, right? 29:54.200 --> 30:00.120 That we feel a little bit more comfortable about using it in ways that we don't feel comfortable in using it right now. 30:00.120 --> 30:04.620 So like I said, I don't know if this is an actual prediction or just what I want. 30:04.720 --> 30:06.440 I think it's a prediction. 30:06.440 --> 30:07.920 I do, I honestly do. 30:07.920 --> 30:16.340 I think this is going to be kind of the hot term next year, taking known good data and kind of double checking at that and trying to incorporate that and kind of taking this to the next level. 30:16.340 --> 30:21.540 Because once again, I think we're honestly playing with the Model T version of this tech. 30:23.480 --> 30:28.600 For now, these large language models, they can still be incredibly useful. 30:28.940 --> 30:34.740 But what you need to think through is the risks versus the rewards of possible hallucinations when you're using this, right? 30:34.840 --> 30:46.600 If you're sitting there using large language models to analyze things and make recommendations that you're like acting on, Lord help you, right? 30:46.600 --> 30:47.860 Like that's risky. 30:47.860 --> 30:49.780 That's very, very risky right now. 30:49.940 --> 31:05.620 But if you've got a bunch of data that you're not doing anything with, and you use large language models, be it logs, be it something else you're collecting, and you're using large language models to churn through that and try to identify things that maybe you should look at, 31:05.620 --> 31:08.740 if you're not looking at it right now, what in the heck is the downside? 31:08.740 --> 31:12.820 Like seriously, what is the downside of using it in that way? 31:12.960 --> 31:19.540 And so right now with the current state of the tech, if we think about implementing this, I think that's what we have to think about. 31:19.620 --> 31:22.400 We know that hallucinations are real. 31:22.560 --> 31:23.540 We see it. 31:23.540 --> 31:26.140 If you've played with this tech, you've experienced it too. 31:26.560 --> 31:28.380 But the capability is so powerful, right? 31:28.380 --> 31:32.160 We just think of what are the downsides, where it is appropriate to use and where it isn't. 31:33.640 --> 31:40.920 And obviously, it kind of goes without saying in this crowd, but we want to think about OPSEC, right? 31:40.920 --> 31:48.360 We want to think about putting these things into ChatGPT, and we've already seen some instances of that, right? 31:48.380 --> 31:52.360 I gave ChatGPT on purpose some API creds the other day. 31:52.360 --> 31:56.720 I was testing something and asked it to write some Python codes using these API creds. 31:56.720 --> 32:01.140 It yelled at me for giving it the API creds, but then it generated the code, right? 32:01.140 --> 32:05.660 So it tells you not to, but then it does what you ask anyway. 32:06.100 --> 32:11.300 And we have these local language models that are unbelievably impressive. 32:11.460 --> 32:19.480 If you've played with Lama, if you've played with some of the others, Vicuna, when that came out, or now the new Lama 2, what are they saying? 32:19.480 --> 32:25.280 I think they said Vicuna was what, like 92% to 93% of the capability of ChatGPT. 32:25.280 --> 32:29.260 To have that running on a local system is amazing. 32:29.300 --> 32:39.880 But if you played with this tech, and you have, like, normal consumer-grade hardware, then you know how unbelievably slow it is, right? 32:40.160 --> 32:41.920 Unbelievably slow. 32:41.920 --> 32:45.600 Like, just through molasses. 32:45.600 --> 32:48.040 Very, very difficult to use. 32:48.220 --> 32:56.680 Right now, the GPUs that, like, professionals are using with this are ridiculously expensive, right? 32:56.680 --> 33:04.340 Like, look up, like, the NVIDIA A100s, and you see, like, these $16,000 video cards with 80 gigs of RAM. 33:04.480 --> 33:13.420 Did you ever think that we would live in a world where you would see $16,000 graphic cards that weren't even designed to be hooked up to a monitor? 33:14.940 --> 33:16.740 It's disgusting, right? 33:16.740 --> 33:24.520 And that's what it is, is you have to load these large language models kind of into the RAM of your GPU, otherwise the performance is even worse. 33:24.860 --> 33:28.300 And so if you're trying to do that on, like, an 8-gig GPU, it's brutal. 33:28.300 --> 33:29.780 You need that more memory. 33:29.940 --> 33:34.320 And so that's another thing, and it's, like, I don't know how much prediction, how much wishful thinking. 33:34.400 --> 33:43.120 I'm really hoping between NVIDIA, AMD, maybe some other dark horses, or I don't know, Microsoft, Facebook, a lot of other companies are looking at developing their own hardware now. 33:43.260 --> 33:49.900 But I hope we start to see some graphics card hardware that's designed for consumers and it's designed for this. 33:49.900 --> 34:00.980 Because right now, if you look at video cards with a 4090, the NVIDIA 4090 with 24 gigs of RAM, I think that's the most RAM we're getting right now on a graphics card that's designed for a consumer. 34:01.840 --> 34:08.380 But the RAM, as the video cards get faster and faster, the RAM almost just kind of comes along with it for the ride. 34:08.380 --> 34:14.020 I really hope we start to see a trend where we're seeing cards that maybe don't have this cutting edge performance. 34:14.020 --> 34:18.300 We don't need it for playing video games or whatever else we're doing, but it has more RAM. 34:18.600 --> 34:18.660 Right? 34:18.660 --> 34:19.860 We start to kind of see it on that. 34:19.860 --> 34:21.400 Just the same way with cryptocurrency, right? 34:21.400 --> 34:23.660 It's not the exact same problem, obviously. 34:23.660 --> 34:25.340 It's not one specific algorithm. 34:25.340 --> 34:28.960 But in cryptocurrency, right, everyone was using video cards. 34:28.960 --> 34:29.680 And then what happened? 34:29.680 --> 34:30.880 They came out with ASICs, right? 34:30.880 --> 34:35.480 They came out with those specialized devices that were a lot better, that use less power. 34:35.500 --> 34:36.880 I'm hoping we see a similar thing. 34:36.880 --> 34:43.980 I'm hoping we see consumer-grade cards that focus more on RAM so we can use these language models than what we have now. 34:47.520 --> 34:56.740 If you pay attention to social media, Twitter, X, whatever it's named next month, right, whatever you're on, you always see people now, Reddit, the ChatGPT. 34:56.740 --> 35:03.560 I think half the posts on the Reddit ChatGPT subreddit are on how ChatGPT is getting dumber, right? 35:03.560 --> 35:04.440 It's just getting dumber. 35:04.440 --> 35:05.560 It's getting dumber. 35:07.740 --> 35:08.820 Kind of. 35:09.820 --> 35:11.200 Let's be honest. 35:11.600 --> 35:20.540 When this tech first came out late last year and into, I think, probably about March, it was a race to impress us. 35:20.860 --> 35:21.860 And it worked. 35:22.180 --> 35:23.640 It worked, right? 35:23.960 --> 35:25.580 That race was canceled. 35:25.580 --> 35:26.920 I hate to break it to you. 35:27.000 --> 35:28.620 They didn't send out a notice. 35:29.140 --> 35:32.260 The reason the race was canceled, it's a new race now. 35:32.440 --> 35:34.340 It's a race to limit liability. 35:35.660 --> 35:35.920 Right? 35:35.920 --> 35:37.160 Think about this. 35:37.160 --> 35:46.100 The number two person at OpenAI went on a TED Talk earlier this year and was telling stories of how ChatGPT has helped people. 35:46.160 --> 35:52.180 And he told a story about a guy who had a dog that was sick and the guy couldn't afford a vet. 35:52.180 --> 35:57.400 So he used ChatGPT to diagnose it and was literally able to save the dog's life. 35:57.520 --> 36:01.520 The number two person at OpenAI told that at a TED Talk earlier this year. 36:02.220 --> 36:05.180 And now they're removing functionality like that. 36:05.700 --> 36:06.280 Right? 36:06.280 --> 36:10.840 And you see people that were like, couldn't afford a therapist, that were using ChatGPT. 36:11.020 --> 36:14.040 And in their opinion, really getting real benefit from it. 36:14.100 --> 36:15.500 You can't do that anymore. 36:16.420 --> 36:16.900 Right? 36:16.900 --> 36:18.820 And so, yeah, it really has shifted. 36:18.820 --> 36:23.800 I made that statement last week in Austin and I had someone come up to me after my talk. 36:24.940 --> 36:31.600 And I won't say who he is and I won't say what company he works for, but it's one of the big ones in this space and he's like, you're absolutely right. 36:32.180 --> 36:39.000 He said, I'm in meetings basically daily with that team and 90% of what we talk about is limiting liability. 36:39.400 --> 36:40.360 I get it. 36:40.360 --> 36:41.560 I hate it. 36:41.980 --> 36:43.460 I absolutely hate it. 36:43.460 --> 36:43.600 Right? 36:43.600 --> 36:45.400 I want the functionality, but I get it. 36:45.600 --> 36:47.320 But what is that going to do? 36:47.340 --> 36:49.620 That's just going to force us, right? 36:49.620 --> 36:58.220 Once we have these more unrestricted models, as people start to basically have this capability with no restrictions whatsoever, that's just YOLO. 36:58.400 --> 37:00.180 We're all going to switch to that. 37:00.380 --> 37:02.780 I mean, we just really, truly are, right? 37:02.780 --> 37:04.440 And so it's weird. 37:05.260 --> 37:11.220 Sometimes I just want to grab a bucket of popcorn and I'm being perfectly honest, a lot of whiskey. 37:12.900 --> 37:14.560 Those of you that know me know that. 37:14.940 --> 37:17.040 And just kind of sit back and see how it goes. 37:17.040 --> 37:18.780 Because I'm going to be fascinated to see how it plays out. 37:18.780 --> 37:25.180 Because like I said, all the major players in this space focusing on limiting liability, that's not going to play well long-term with the consumer. 37:25.780 --> 37:27.500 It's just absolutely not. 37:27.500 --> 37:28.900 So we'll see. 37:28.900 --> 37:30.200 We'll see where it goes. 37:30.320 --> 37:36.860 And I was like, I just asked mid-journey for a race pick last night and it gave me this and I'm like, well, that's going in the talk. 37:37.340 --> 37:39.000 The rabbit has no meaning. 37:39.000 --> 37:40.300 I just like the rabbit. 37:41.920 --> 37:44.900 Let's look a little bit at code analysis, right? 37:44.900 --> 37:48.440 As far as things that we can do for reconnaissance a few different ways. 37:50.540 --> 37:58.580 One thing that I do in my SANS class is I always stay late on day one and try to help out people who have never used Linux before to get a little bit more familiar with it. 37:59.420 --> 38:04.600 And a lot of people have like want to get better with Linux, right? 38:04.600 --> 38:09.760 And OSINT, that's kind of one of the things, usually the two things that people really want to focus on when they're getting started in the space. 38:09.820 --> 38:14.060 I want to get more comfortable with Linux and I want to get more comfortable with Python, right? 38:14.060 --> 38:14.700 Or programming. 38:14.700 --> 38:17.760 If you want to learn programming in some other language, switch to Python. 38:18.160 --> 38:20.480 Unless you're trying to bypass A, B. 38:20.480 --> 38:21.780 No one here is, probably. 38:22.120 --> 38:27.680 But then you always have these people that give you horrible advice. 38:27.680 --> 38:29.660 Like, really, why should I use Linux? 38:29.660 --> 38:32.140 Because then you can customize it like bro. 38:32.780 --> 38:34.920 They're just trying to get started with the command line. 38:34.920 --> 38:36.920 You want to start making kernel modifications? 38:36.920 --> 38:38.080 Like, calm down. 38:38.680 --> 38:40.760 Let's be a little bit realistic right here. 38:40.760 --> 38:45.520 I think that advice, honestly, on why you should learn these things is sometimes disingenuous. 38:45.960 --> 38:48.520 Analyzing source code isn't always easy. 38:48.720 --> 38:54.060 And this right now, once again, large language models are made to order for this. 38:54.060 --> 38:58.760 There are some problems that these just eviscerate, right? 38:59.320 --> 39:02.440 I had some Python code for a project on GitHub. 39:02.580 --> 39:03.980 I tried to give chat GPT. 39:03.980 --> 39:07.120 Chat GPT doesn't take a whole lot of information right now . 39:07.120 --> 39:13.020 There's a very limited amount of tokens that you can only give it so much text to ask a question. 39:13.360 --> 39:16.300 Google BARD has a much higher limit, right? 39:16.460 --> 39:21.200 I think most of us in here use Google as our default search engine. 39:21.200 --> 39:22.860 Some use DuckDuckGo, some use other. 39:23.140 --> 39:24.240 It sounds weird. 39:24.240 --> 39:25.680 Hey, John, just Google it. 39:25.680 --> 39:26.640 He's like, okay. 39:26.660 --> 39:28.620 If I said, hey, Zobin, just Bing it. 39:30.220 --> 39:32.540 Half of us would win, half of us would last. 39:32.540 --> 39:33.980 It's a good search engine. 39:33.980 --> 39:34.460 It is, right? 39:34.460 --> 39:37.480 And let's be honest, it has a lot of results in it that Google doesn't. 39:37.480 --> 39:42.820 There's a lot of content that maybe is a little more shady, illegal that's in Bing that you won't find in Google. 39:42.820 --> 39:46.140 Not to get political or tinfoil hattie, it just is. 39:46.740 --> 39:50.860 The same way a lot of people sleep on Bing do not sleep on Google BARD. 39:50.860 --> 39:54.140 Google BARD when it first came out was getting laughed at. 39:54.380 --> 39:56.500 It has improved a lot, right? 39:56.500 --> 39:57.740 It really has. 39:57.780 --> 40:06.680 And so here I took that GitHub code of a project and I gave it to Google BARD and asked it to analyze the code and explain it to me. 40:07.300 --> 40:08.960 And it did it. 40:09.060 --> 40:11.620 And it did a really, really good job. 40:12.220 --> 40:18.320 I was at a mixer last night with a bunch of cyber threat intelligence analysts sitting around. 40:18.780 --> 40:23.600 And I had one guy who started talking to me and the subject of like AI came up. 40:24.080 --> 40:27.900 And right now he's taking a lot of advanced math classes, right? 40:27.900 --> 40:29.240 Working on crypto. 40:29.790 --> 40:38.160 And he said there was one problem that he did not understand and his professor could not explain it to him. 40:40.480 --> 40:48.260 He took that problem to ChatGPT and it gave him a very clear concise explanation that was accurate. 40:49.340 --> 40:50.860 That is insane, right? 40:50.860 --> 40:58.960 I had someone last week in Austin ask me if it's between ChatGPT doing something for you and learning, which way should you go? 40:59.260 --> 41:01.140 Yes, right? 41:01.260 --> 41:03.720 Use ChatGPT to help you learn. 41:04.640 --> 41:06.260 Don't just ask it to write the code. 41:06.260 --> 41:08.000 Ask it to explain it to you. 41:08.180 --> 41:10.280 You've got a Python project you want to run, right? 41:10.280 --> 41:12.120 And once again, you always have those same people. 41:12.120 --> 41:14.480 Well, now you can look at the code and understand what it's doing. 41:14.480 --> 41:16.880 Well, kind of, but that gets tough sometimes, right? 41:16.880 --> 41:20.700 If you try to look at my code, you'll be able to understand it. 41:20.700 --> 41:23.400 No, because it's basically like me building Lego blocks. 41:23.400 --> 41:24.600 It's pretty straightforward. 41:24.600 --> 41:27.440 You try to look at code written by a professional developer. 41:28.040 --> 41:28.840 Nope. 41:28.960 --> 41:31.080 But here, it does an amazing job. 41:31.080 --> 41:37.920 And it's not just about programs that you want to run to kind of get an assessment of what it does, how it works, and if it's safe to run. 41:39.020 --> 41:40.740 But what about websites, right? 41:40.740 --> 41:45.900 What about analyzing JavaScript on websites to see if it's tracking you? 41:46.160 --> 41:47.540 It's fantastic for that. 41:47.540 --> 41:51.520 So, if you ever look at JavaScript on websites, it's not plain English, right? 41:51.520 --> 41:53.120 It's very, very obfuscated. 41:53.120 --> 41:57.900 They try to make it hard to figure out what it's doing a lot of times on purpose. 41:59.060 --> 42:02.240 Here, once again, was a lot of JavaScript. 42:02.960 --> 42:04.420 Why are you taking a screenshot of this? 42:04.420 --> 42:06.000 Come on, this is ugly JavaScript. 42:06.240 --> 42:07.660 I'm just kidding with you. 42:07.660 --> 42:10.840 No, this was not the entire JavaScript. 42:10.840 --> 42:15.680 If I put the entire JavaScript on here, it probably would have been about eight slides. 42:15.860 --> 42:19.040 Like, it was not a small function. 42:20.500 --> 42:22.960 I could probably figure that out. 42:22.980 --> 42:28.500 I would not be sober by the end of it, so my results would slightly start to get worse and worse, right? 42:28.500 --> 42:30.520 I've done this type of stuff before. 42:30.540 --> 42:31.600 I can do it. 42:31.600 --> 42:33.660 It kind of sucks, if I'm being honest. 42:34.100 --> 42:35.780 I give this to ChatGPT. 42:35.980 --> 42:38.060 ChatGPT is like, that's way too much, dog. 42:38.060 --> 42:38.540 All right. 42:38.540 --> 42:42.820 I give it to Bard, and Bard just does it. 42:43.220 --> 42:49.140 It sits there and explains what all the functions do. 42:50.800 --> 42:59.580 And then at the very bottom, it actually gave me a link you'll see here in a little bit, where it's like, hey, do you want all this in a table? 43:00.180 --> 43:00.500 Right? 43:00.500 --> 43:02.520 It's really, really kind of ridiculous. 43:02.520 --> 43:12.900 But here, that JavaScript that was clearly tracking, designed to track website visitors, it gives us a breakdown of exactly what it's tracking and exactly how it's doing it. 43:12.900 --> 43:19.200 Once again, I could do this without it, but before I was finished, I might gouge my eyes out with a rusty spoon. 43:20.240 --> 43:28.780 And so here, like I said, the code was clearly used for tracking visitors, and there were some other sites, and I was trying to tell, is this the same entity? 43:28.780 --> 43:34.060 Is the same entity that's tracking on this site also the one that's tracking on this site? 43:34.060 --> 43:39.200 Because at first glance, the JavaScript looks roughly similar. 43:40.820 --> 43:52.560 I didn't even have to paste the JavaScript into Bard, because what, two months ago now, more or less, ChatGPT killed the browsing functionality. 43:52.560 --> 43:54.020 Bards is still alive and well. 43:54.020 --> 44:04.020 I gave Bard the link to those two JavaScript files on the two different sites and asked it to compare the JavaScript to see how similar they were. 44:05.680 --> 44:06.780 And here it is. 44:06.780 --> 44:14.900 It breaks down the key differences between the files, the way they handle errors, the way they deal with variables, right? 44:14.920 --> 44:16.680 It gives the pros and the cons. 44:16.760 --> 44:20.160 It breaks down the styles being different. 44:20.280 --> 44:23.780 The second library is more object-oriented, robust, and portable. 44:23.920 --> 44:30.000 And then at the very bottom, thank you, here's a table that summarizes the key differences between the two libraries. 44:30.880 --> 44:36.080 And it gives it to me in a table with a little button to export it out to Sheets. 44:36.500 --> 44:42.440 Anyone who's done this manually, like seriously, right? 44:42.440 --> 44:43.220 This is the way. 44:43.220 --> 44:46.220 This is like I said, oh, these things, they hallucinate. 44:46.220 --> 44:47.940 You can't use these, really. 44:48.820 --> 44:52.880 Because in ways like this, this is it, right? 44:52.880 --> 44:54.560 This is absolutely it. 44:55.820 --> 44:59.000 My time is almost up, so let's talk about report writing really quickly. 44:59.000 --> 45:01.320 Everyone's absolute favorite thing, right? 45:01.540 --> 45:08.120 And I used to tell my analyst all the time, you can spend a week doing things that are clever and very, very impressive. 45:08.280 --> 45:11.280 You're not being judged on any of it, right? 45:11.280 --> 45:15.580 The only thing you're being judged on is what goes in that email that you push send on. 45:15.580 --> 45:16.840 So make it good. 45:18.840 --> 45:21.780 Let's see how large language models can help us. 45:21.900 --> 45:23.520 First things first, right? 45:23.520 --> 45:31.760 You try to ask chat GPT to write something for you, a lot of times it comes up with some good stuff, but it's not nearly good enough to copy paste, right? 45:31.760 --> 45:41.440 You just basically, how I've been using it a lot of times up until recently was asking it for a lot of ideas and then picking and choosing, mixing and matching, copying and pasting, right? 45:41.440 --> 45:43.100 It is good with writer block. 45:43.160 --> 45:46.100 Let's look at a few things that can help us though when it comes time to report writing. 45:46.100 --> 45:47.580 Number one is very simple. 45:48.200 --> 45:51.760 Identify a writing sample that you think represents you well, right? 45:51.760 --> 45:54.600 It has your tone, it has the way you explain things. 45:55.340 --> 45:58.040 Take that writing sample, save it in a text file. 45:58.040 --> 46:02.360 My buddy Josh has his saved in Obsidian in there because that's where he's organizing everything. 46:02.720 --> 46:08.420 And every time he goes to ask chat GPT to write something, he first gives it that writing sample. 46:08.420 --> 46:10.280 I'm getting ready to ask you to do something. 46:10.280 --> 46:12.420 I want you to write it in this style. 46:12.420 --> 46:16.520 And it's just a copy and paste from, like I said, a text file, Obsidian, wherever you want. 46:17.020 --> 46:21.480 And then you watch, watch how much better the output is. 46:21.480 --> 46:25.180 It is dramatically better and it's in your style, right? 46:25.180 --> 46:28.580 So things that are your style, you just tend to like more anyway. 46:29.200 --> 46:35.020 And for the final thing here, chat GPT isn't great at turning a six-word prompt. 46:35.020 --> 46:36.680 Everyone's like chat GPT is getting dumber. 46:36.680 --> 46:39.580 You gave it six words and asked it to write your thesis. 46:39.580 --> 46:40.720 Stop, right? 46:41.080 --> 46:44.880 It's not good at taking six words and turning that into some masterpiece. 46:45.160 --> 46:49.480 But if you gave it a thousand words right now, now it's going to do good. 46:49.480 --> 46:51.440 But the problem is I don't want to type that. 46:51.460 --> 46:54.040 Ain't no one got time for all that, right? 46:54.040 --> 46:57.200 So what we can do now is start to combine some of these things. 46:57.620 --> 46:59.880 Record yourself explaining what you want. 47:00.280 --> 47:01.660 You can use an app on your phone. 47:01.660 --> 47:02.380 You can use Whisper. 47:02.380 --> 47:03.500 I don't care what you use. 47:03.760 --> 47:06.200 Transcribe what you just explained into text. 47:06.400 --> 47:12.680 Now give that text to chat GPT or BARD and now ask it to write what you want, be it a report or something else. 47:12.680 --> 47:19.180 How many times do you go to send an email to a friend and you realize there's no way I'm going to send this email. 47:19.180 --> 47:26.460 I'm just going to call them because this is going to take me 15 minutes to write the email or it's going to take me two minutes to explain on the phone. 47:26.500 --> 47:30.420 Why do we think it would be any different with chat GPT, right? 47:30.420 --> 47:33.740 So if we can harness that, if we can take our voice and explain what we want. 47:33.740 --> 47:35.820 I almost feel like I'm talking to a toddler, right? 47:35.820 --> 47:39.860 Use your words and then ask it. 47:39.860 --> 47:41.920 Once again, a lot better results. 47:42.160 --> 47:44.420 So there's a lot of different ways we've talked about here, right? 47:44.460 --> 47:47.000 Transcribing, translating, summarizes. 47:47.000 --> 47:49.980 And once again, as far as how we're going to use this, it's on us. 47:49.980 --> 47:51.700 It's on the people that are in this room. 47:51.860 --> 47:57.620 It's on the people that are watching online to think of how we can use this technology for good, right? 47:57.900 --> 48:02.440 If you want to get a hold of me, I am the easiest person in the world to get a hold of, right? 48:02.440 --> 48:03.600 I shouldn't even insult you . 48:03.600 --> 48:05.100 This is Reconnaissance Village. 48:05.500 --> 48:11.800 I am Matt0177 on what used to be Twitter, now X, whatever you want, right? 48:11.800 --> 48:13.880 Matt at ArgeliusLabs.com. 48:14.000 --> 48:16.800 If you want to hang out and talk OSINT, I put some stickers on a table over there. 48:16.800 --> 48:17.680 I don't know if they're still there. 48:17.680 --> 48:18.540 They're already gone. 48:18.620 --> 48:19.800 But we have a lot more stickers. 48:19.800 --> 48:20.960 We have challenge coins. 48:21.060 --> 48:25.500 The room wasn't ready yet, but we're actually going to post up at the hospitality suite at the top of the horseshoe. 48:25.660 --> 48:26.460 And I have stickers. 48:26.460 --> 48:27.060 I have coins. 48:27.060 --> 48:30.620 If you want to hang out and talk OSINT, talk about the SANS class, whatever, let me know. 48:30.700 --> 48:35.380 And also, there's no way I have a hospitality suite that is not fully stocked with alcohol. 48:36.640 --> 48:39.560 And when I say a case of bourbon, I mean a case of bourbon. 48:39.560 --> 48:41.060 So like I said, I'm easy to get a hold of. 48:41.060 --> 48:42.300 If you want to hit me up, hit me up. 48:42.300 --> 48:44.360 Slide into my DMs and let's chat. 48:44.360 --> 48:45.700 So thank you all for your time. 48:45.700 --> 48:46.380 I appreciate it.