start	end	text
0	6820	Good morning everyone and welcome to the village talk area. I am Tony, or ToughNuts. We're with
6820	12240	the Packing Hacking Village. We are just across the way. Come, please, and visit us. And it is
12240	17720	my great pleasure to introduce Will, who is going to be talking about some stuff you've found
17720	23560	about leakage of data in social media. So, without much to do, if I could get everyone to
23560	36720	please sit down. Hold on, D9. Can you? There we go. And Will, with that, thank you very much.
36720	48200	Here you go. Hi. Could I get a show of hands in the audience, those of you who use Reddit?
49560	56560	Awesome. Keep your hand raised if you subscribe to the DEF CON subreddit. Good. And one last
56560	63540	question. Of those few, keep your hand raised if you post or comment to the DEF CON subreddit.
65100	72180	Not too many, just one. All right, that's okay. Yeah, I was hoping for a few more, but that's okay.
72180	77440	None of them are here. We can talk as much as we want about them. Yeah, so you've probably read
77440	84080	the program. This talk is about me spending the last 12 months, call it what it is, stalking the
84080	90500	DEF CON subreddit, seeking people's personal information that they might be leaking online.
91460	98820	So, yeah, thanks for coming. Language warning, maybe. Information warning, definitely.
99380	104120	Particularly anyone who had their hand raised in the last couple of questions, there is a small
104120	111140	chance that you individually may be on these slides in the next 45 minutes or so. But don't freak
111140	117640	out. I've done my due diligence. There's plenty of black text all over the slides, so you probably
117640	125440	wanted to recognise yourself. Yeah, I just wanted to say before I started as well, this is meant to
125440	131440	be a no prior knowledge required speech, so if you have any questions, can we just leave them
131440	140640	till the end, and I'm happy to answer them after that. Let's get on with it. Yeah, obligatory intro
140640	148720	slide. My name's Will. I'm from Australia. I work for a cyber security firm there. My day job is
148720	156940	actually not related to this at all. I work in cyber security in the supply chain. So if you're
156940	161280	looking through the brief and you're wondering what the hell has this got to do with that,
161280	168540	you'd be 100% right. It has nothing to do with it. And also, yeah, I guess when I started as well, I
168540	178260	had almost none of the skills required and probably still don't to do this kind of thing. I'm not a
178260	185000	coder. Pretty shit at code. I'm not a social engineer. And you probably get that from my shitty dad
185000	192140	jokes and my poor taste in memes. And I'm certainly not a data scientist. I have no ability to wrangle
192140	200600	large data sets. So yeah, if you're in the audience and you are professional in any of those areas, I
200600	208640	apologize in advance. I'll probably butcher your fields of expertise and misrepresent entirely. But
208640	218010	yeah, I just, I didn't have any of that stuff and just had a crack at it anyway. So this is my
218010	223810	second DEF CON. I came here last year as like a bucket list thing with a few friends. We went and
223810	228470	visited the wall of sheep. If you haven't been there, I recommend doing it at some point in the
228470	233450	conference. And we love the idea of like a practical way of kind of showing people what they
233450	239830	were leaking on a network, an unsecure network. And yeah, we thought that was an awesome idea.
239830	246130	And like most things, after a few refreshing beverages, we kind of thought to ourselves, that's
246230	252730	a really awesome idea. You know, during the conference, showing people over those four days,
252730	257890	what kind of stuff they're leaking. But what about all the stuff that people are leaking 365 days
257890	265710	of the year, sharing on social media, everything about themselves. And yeah, from there, we were
265710	271270	like, wouldn't that be a cool way? Wouldn't that be a cool presentation to sort of collate all that
271270	276830	information? And yeah, present it back in a kind of like wall of sheep online edition. So that's
276830	282350	what we kind of came up. So this is what we're going to be talking about. What would a wall of
282350	288290	sheep online edition look like? Starting with my most overconfident plans, you know, someone with
288290	294490	no ability to do it, deciding to go and do it. Yeah, what even is a leak? Took a little bit of
294490	301430	time to kind of like have to work that out. I had no idea what I was looking for or defining what
301430	307030	that was going to be. I needed to learn the recon game. I had no kind of clue what was going on
307030	311550	there. And then sort of like the rest of this talk is really just talking about how I started
311550	317250	hunting and gathering and finding those people. And then I promise, if you sit through all that,
317250	323810	the last few slides, we'll be talking about sort of the most juicy slide packs of people that I
323810	332780	found. Yeah, so I was like, how hard could it be? You know, everyone knows people leak stuff online.
332780	338260	Everyone knows people overshare all the time. Social media these days has us lulled into this
338260	344160	idea that, you know, oversharing is what you should be doing on social media. So I was like,
344160	350020	I'll just find some target group, come up with some things to look for and then, you know,
350020	355780	manually sift through and just try to find interesting folks. And then shortlist those people
356320	361400	and then monitor those juicier profiles. And that was kind of it from the beginning. I was like,
361400	367100	you know, had no real grand plans to actually do a talk like this. It was actually just for shits
367100	372120	and gigs in the sidelines. And then just sit and wait, essentially, see how long it took.
373500	376680	And then at some point, we're like, oh, yeah, wouldn't it be awesome if we actually just went
376680	383960	after the DEF CON community instead of just any random community for a few reasons.
384860	388440	So as you're probably aware, if you are all those people who are in the DEF CON subreddit, there's
388440	395480	also a whole bunch of other social media platforms that the DEF CON attendees like to use, such as
395480	402980	the forum, such as the Discord, and yeah, and the Reddit group. So all of those things kind of
402980	407480	is really helpful because they all have great history. There's heaps of discussion on there.
407480	410240	There's all different types of people on there, different skill sets.
411280	416580	And one really awesome thing about you hackers is you like to reuse your handle everywhere. So
416580	420100	that was really good to kind of like just track people across those three different areas.
420640	427460	And also it's on topic. But yeah, for the rest of the brief, though, I actually just focused on
427460	435440	the subreddit. So yeah, where the hell do I start? I was like, it's one thing to sort of come up with
435440	440520	this idea that wouldn't it be funny to scrape a whole bunch of social media, but without any kind
440520	446620	of idea of what to do or where to find the information, what am I even looking for? I was
446620	457200	kind of like in a bit of a pickle in terms of actually starting. So yeah, we're all kind of
457200	462920	aware of what PII is, personal identifiable information. I was pretty full bottle on what
462920	468620	that kind of meant, you know, your name, date of birth, social security number you guys have,
468620	472160	all that kind of like basic stuff. I was pretty sure I could find that kind of thing.
472380	477060	But what about all the other stuff that people leak in terms of like their own personal information?
478020	483920	It was kind of a pretty wide scope and I didn't really have much direction as to how to sort of
483920	489500	define it or where to find it or any kind of like ability to do that at that stage.
490800	496700	Fortunately, back home at my company, I had a guy who's sitting right next to me
496700	507000	who has a PhD in cognitive behaviour and sort of is a proper scientist regarding that. And he was
507000	512800	actually researching at the time the tendencies, the language and the behavioural patterns of
512800	519560	people preceding OPSEC incidents. And so I was like, Riley, tell me how to find this stuff
519560	525820	or is there any manuals? Tell me how to like search for it. And he pointed me down the track
525820	531620	of, you guys have some amazing resources here in America, your three-letter agencies like CIA, FBI,
532680	536960	the National Centre for Counterintelligence all have really great
538120	541560	manuals and doctrine online. And I was like, that's a really great place to start.
543220	547220	And not, sorry, not forgetting the social engineering community here was a really awesome
547220	553580	treasure trove of sort of ways to find individuals and sort of target individuals. So I used all that,
553580	560280	all those kind of resources to kind of guide me in how I was going to find this other kind of
560280	567120	information beyond PII. And yeah, I came to the, they were all sort of pointing to the idea that
567120	574880	there are these sort of like vulnerable, sort of personal vulnerability traits or more easily
574880	581300	manipulated life situations or sort of like leverageable information. Yeah, like, you know,
581300	587420	the Russians call it kompromat. And I was like, ooh, kompromat. I think I'll add that to my list
587420	593880	of things I'm looking for beyond the sort of normal names and addresses and things like that.
594440	599880	And my kind of simple mind could sort of track that as a kind of like easy way for an attacker
599880	605280	or a malicious actor to search for, you know, stuff to find like a soft target. So I was like,
605280	613200	that, that makes sense. Yeah, so I came up with this idea or this term called PVI,
613200	619460	personal vulnerability information, you heard it here first, as opposed to traditional PII.
620140	625880	Traditional PII is just those like super basic attributes that we're all kind of aware of and
625880	634340	that organizations and governments, government policy like to, or have in their, in their
634340	640540	policies to protect. And your standard security awareness programs also have this stuff in it
640540	644960	as well. It's mostly, you know, don't put this stuff online. But if you compare that to all the
644960	652740	other stuff that are people leaking, and, you know, isn't necessarily protected by this
652740	657900	legislation or policy, you kind of have to ask yourself, like, which one do I, which one would
657900	663820	I prefer to see in a leak? And also, which one am I actually leaking myself all the time?
667240	672640	See, I was beginning to see, I was beginning to learn that PII is sort of like just scratching
672640	680080	the surface in terms of like online targeting of people. Yeah, and I was really realizing that
680080	686340	like the real bad dudes out there are actually searching for people who maybe will leak rather
686340	691900	than people who already have leaked. And so if you think about all those things on that original
691900	697500	slide, I was talking about all those like PII versus PVI, all this stuff that you might be
697500	705160	in the blue column over here, have this like, provides an attacker with options to target you.
707720	712960	So I was like, who are these bad dudes who are using this kind of stuff? And in all of the
712960	717080	research that I was doing, I was realizing that, you know, it's not just the usual suspects that
717080	721680	we're talking about here. I'm not just talking about APTs and hacktivists. We've all heard the
721680	728300	stuff about, you know, online radicalization of young jihadis and things like that, which
728300	735200	actually also adding, you know, stalkers, jealous ex-partners, child predators, all of these other
735200	739900	malicious actors online who are using the exact same methodology of trying to find vulnerable
739900	750440	targets using the language that they're presenting online. Yeah, so I had the what. I was like, okay,
750440	754740	that's great. I'll be searching for actual facts about people and then kind of like personality
754740	760560	types, language use, and those kind of things. Now, how the hell do I find that stuff on,
760560	767880	you know, large, large space of information? So if you've been working in cyber security for
768320	772640	a minute, you'd be aware of the intrusion kill chain. Just wanted to put that up there.
772900	777640	We are definitely in the reconnaissance phase here, just researching, identifying,
777640	782220	and selecting targets. And I was kind of trying to work out like how I was going to do this.
782220	786400	So I just decided to smoosh all this kind of like, all these different organizations,
786400	793800	methodologies into one kind of, into one, like my plan. So use the CIA's
795580	802100	methods of like spot assess and develop, and also mixed in a bit of like the military concept of
802100	808480	find, fix, finish. And using those things, using those resources online, like, particularly want
808480	815000	to add the Department of Justice has awesome annals of, you know, cases here in America,
815000	819760	like they kind of document exactly how espionage cases unfolded and how those people were
819760	825700	approached online. Yeah, and I came up with the idea of like find, fix, follow, which I realize
825700	833900	is just, it's just pretty rudimentary, but sorry, fix, find, follow. So I fixed, chose the haystack,
833900	838920	chose the DEF CON subreddit. I was going to find those people using those terms amongst
838920	845820	the anonymous users, anonymous users, and then assess for leakage, leakability, and tag those
845820	851200	people for monitoring. And really at this stage, I was just doing this pretty rudimentary, just
851200	858040	control F, you know, finding, finding words. So it's pretty basic at this stage.
863630	867390	Yeah, so sort of coming to the part where I started, started doing it. So I had to have
867390	873110	some assumptions to start with, was deciding that like people who reveal in DEF CON, sorry,
873110	878090	Reddit slash DEF CON will reveal elsewhere is a pretty basic kind of assumption.
879430	885530	If you're not aware, the DEF CON Reddit is pretty small. It's pretty small traffic, low traffic,
885530	889570	sorry, compared to other subreddits around there. And it's going to be a pretty small
889570	895450	percentage of those users posts. So I was like, okay, if I find situations in that,
895450	899490	I'm just going to track where else they're posting and try and find more information from that point.
900470	904850	Yeah, people who reveal big things probably do small ones also. That's a no-brainer.
905010	911610	There is going to be old information. It's very old, you know, it's not very old, but as years go by,
911610	915790	there's going to be stuff where people have changed, changed the information that they're
915790	922790	presenting. And of course, there will be deception because, you know, I realise you guys, you hackers
922790	929850	are slippery bastards. So I was really just searching for things like I work for, my email
929850	936430	address is, my name is, and I live in. I realise that's pretty amateur hour, but that's just kind
936430	945250	of like the small brain position I was in to start with. Yeah, scraping was pretty slow,
945250	950430	had limited results. I was really only finding one, two, three things and sort of just slowly
950430	955290	plodding away. And I was limited to those keywords. Well, I'm not limited to those keywords,
955290	959210	but I was limited by those keywords, just searching for those few things that I could think of as
959210	965230	what would be good strings to search for. I wasn't finding the kind of stuff I was after.
965230	971750	And at that stage, I was like, I'm not really hacking this. I'm really just pushing forward.
972570	978250	But then, you know, GPT entered the chat and I started to ask it to help me define those leaky
978250	984050	or vulnerable language and really open up those keywords to much more things than I could consider
984050	991470	as possible things I wanted to search for. And still some manual sifting needed then to,
991470	997670	after I found those initial targets through posts. But those juicy individuals started to grow.
997670	1002870	At this stage, I think I had like two or three people with one or two little posts where I was
1002870	1010970	like, okay, I think I'm starting to develop something here. And yeah, so if you've used
1010970	1017010	chat GPT in the past or currently, you probably know it does require a bit of sort of convincing
1017010	1022090	to get it going. I had to kind of convince it I was reviewing my own chat logs, make sure I wasn't
1022090	1026550	revealing any personal information. And I was quite happy to come up with, you know, things that I
1026550	1033510	should be looking for to try and find PII and PVI. And I was like, awesome. But can you give me
1033510	1038250	the sort of like words that might precede a leak? That would be a bit more helpful than just giving
1038250	1044510	me the concept of the kind of things that people are looking for. Yeah, and I was like, okay, can
1044510	1049550	you give me a hundred different versions of that? Which was really helpful because then I could
1049550	1054910	sort of just still doing my control F, still looking through. At some stage, I discovered
1054910	1061590	there's like a year ago, it was still functioning, was a push shift IO, which is like a website we
1061590	1069150	can do live queries of Reddit data. And I was just really just mandrolically going through
1069150	1073570	and inserting these keywords in there and trying to search and then going back onto the subreddits
1073570	1079570	trying to find the information. It was still very, very clunky. As you can imagine, some of
1079570	1084650	these keywords, some of these sort of preceding strings aren't exactly the kind of language that
1084650	1090550	people are using in the DEF CON subreddit. I received an email from, it's just not the
1090550	1098940	language that's really in there. But I was finding some stuff here and there. Yeah, everything was
1098940	1105300	going pretty great until, if you're a user of Reddit or if you're aware, Reddit halfway
1105300	1109760	through last year or halfway through this year just decided to cut all access to third-party apps
1109760	1117920	and my super powerful search tool just kind of went dark. And I was left sort of... motivation
1117920	1124040	died, regretted not finishing earlier, not producing any slides because I had already
1124040	1130100	actually sent this presentation to DEF CON. So I was like, had nothing. And I was kind of like,
1130100	1134420	six weeks of just like, whatever. It was a smart idea. Well, I thought it was a smart idea to begin
1134420	1144380	with. And I was like, it's probably not going to be possible now. But then, from total failure,
1144680	1152560	I realised that some saint had been archiving Reddit data since the beginning of time. So
1152560	1158720	there was literally every single post, every single comment that had ever been made in Reddit
1158720	1167520	in one gigantic text file. And so I was like, sweet. 50,000 comments, 6,000 posts. Now I wasn't
1167520	1174920	just looking at the last 12 months. I had 18 years worth. The Reddit... sorry, the DEF CON Reddit
1174920	1180640	doesn't go back that far. But now I was really just looking at a decade's worth of comments,
1180640	1187240	which gave me a much more big... sorry, a much larger data set to look through.
1190560	1195860	Yeah, sorry. So at that stage, I was... yeah, so I'm... sorry, it's kind of...
1197840	1200980	one of the problems with doing one of these briefs is you've got to remember what you were doing 12
1200980	1207160	months ago. Now I was working with a text file. So now I'm just really just searching through a text
1207160	1213500	file, you know, using Python to just search for strings within the text file, rather than looking
1213500	1221600	on Reddit online, using the search. But yeah, at some point during the year, I was listening to
1221840	1227200	a Darknet Diaries episode, big Darknet fan. And I was listening to Sam Bent, who he presented last
1227200	1234000	year at DEF CON. He was talking about how he was using... he was trying to circumnavigate the
1234720	1239240	US Postal Service to send drugs through the mail. And he was trying to work out how he was going to
1239240	1243600	do it. And he was like, well, one of the, you know, one of the things, best things about the
1243600	1249040	Postal Service is they have a manual online for what good looks like, what they're searching for.
1249040	1254100	And he was like, I'll just do the opposite. And I was driving along, I was like, I think I could
1254100	1262240	just do the opposite. So I went online to the Australian government website to try and find like
1262240	1266840	the kind of attributes that they are looking for when they're trying to give people
1266840	1270280	security clearances, or they're looking to give people security clearances.
1270560	1275340	And I was looking for attributes for people in that sense, because I was like, well, that's good,
1275340	1281180	that's safe. Those are the things that they think people will present as, you know, being able to
1281180	1287460	keep a secret or being able to, you know, keep the nation's secrets. And I was like, hey, ChachiPT,
1287460	1293960	give me all the synonyms for all of those things. And then also give me all the antonyms for all of
1293960	1299200	those as well. So I came up with a huge list of antonyms of like the types of people that I was
1299200	1308020	looking for online. And then I was like, find me all variations of that. So sort of like just
1308020	1314020	punched out hundreds and hundreds of different sentences, which might suggest the type of person
1314020	1321060	who presents those kind of characteristics. And yeah, now I really felt like I was cooking with
1321060	1325100	gas, because I was not only searching for these things, I was searching for sort of permutations
1325100	1332000	or variations of those, just little chunks of those. And I was really finding a lot of results
1332000	1339600	using this method. Yeah, so I also wanted to find those leak facts. So thinking back to the
1339600	1345760	beginning, I was also trying to find PII. So, you know, from a slow and sort of like noisy scrape,
1346120	1351760	I was now using those kind of that, you know, GPT enhanced powerful semantic search to try and find
1351760	1357900	words, which sort of seemed like the person was either going to leak or had leaked. The search
1357900	1365300	method didn't change for using the PII. I just had to obviously assess the leak's impact.
1365300	1370100	So some stuff that people are leaking is really just sort of basic stuff, like down in this green
1370100	1377680	area. You know, I just put this together to try to like kind of visualise how I was assessing
1377680	1381480	the kind of things that people are leaking. And it's kind of what I call this death by thousand
1381480	1387640	likes, because lots of the stuff, sure, whatever, it's just online. But you know, when you add it
1387640	1394740	all up, it really is and has an accumulative effect. Yeah, so I had to assess the impact,
1394740	1399780	but also like the frequency. If you're, you know, if you have 500 comments in the sort of green,
1399780	1405360	yellow area, maybe that's sort of only worth like one comment in the red area. There's still heaps
1405360	1411460	of error, as you're probably aware. Chachipiti made a lot of things up a lot of the time and it was
1411460	1416960	still very human-driven. I was still searching through and finding. I still had to go through
1416960	1421020	and look through the results and actually kind of prove or disprove whether it was
1421020	1428060	actually what I was looking for. Yeah, as you can probably imagine, 18 years is a long time.
1428200	1432820	I had lots of false positives, lots of like comments that people were making and I was just like,
1432820	1438620	that's nothing. So that was taking quite a lot of my time. It was taking quite a lot of energy and
1439420	1443840	it was pretty boring looking through lots and like hundreds of false positives.
1443920	1449720	There's lots of non-repeat offenders. So like you might make one mistake like one time 10 years ago
1450320	1454500	and post something about yourself and I just sort of like wasn't interested in that.
1455440	1460380	And there was lots of target drop-off as well. So like lots of the people I was looking at,
1460380	1463880	lots of the results was happening a long time ago. Those people might have just like moved on
1463880	1467340	and not even been into security anymore. So I kind of wasn't interested in that.
1467940	1471780	The one thing I want to say about that is like it's only bad in this context, right? So I'm
1471780	1476500	trying to find people, I'm trying to produce slides that are interesting for you guys to look at.
1476500	1482120	If it's a malicious actor, if it's like those stalkers or predators or whatever or more advanced
1482780	1487960	enemies where like you need to imagine like they only need one slip-up or one thing that
1487960	1493700	they're looking for. So it's only bad in this context. Yeah, and today we're only going to
1493700	1498020	look at high-quantity packs. I didn't really put anything together where someone had just made one
1498020	1506280	slip. But I was also thinking now I'm actually, you know, now I've got big brain, big brain mode.
1507080	1511260	And then, yeah, sort of like a couple of months ago, as you're probably aware,
1512360	1520700	OpenAI gave us access to the API. So this was huge. I was like, whoa, god mode. I was now able
1520700	1526380	to just plug the data, the massive text file of all of those comments straight into the ChatGPT
1527260	1536960	prompt and just literally ask it questions about the data. Yeah, so as I said at the start,
1536960	1542120	this is meant to be like a no prior knowledge brief and I certainly had no prior knowledge
1542120	1547720	before I started it. But what it meant was I didn't have to produce any search scripts anymore.
1548220	1552440	I was no longer in charge of coming up with creative versions of the kind of stuff I was
1552440	1561120	looking for. I no longer needed to. Yeah, sorry I said that. I just left it all up to the large
1561120	1566620	language model, which was awesome. It was really limited only by tokens. If you're not aware,
1566620	1571480	when you're asking it questions, you are limited by a number of characters in and out.
1571480	1575940	But that really only just slowed me down. I just had to like chunk up the data into smaller pieces
1575940	1583440	and re-ask the questions over and over. And in the meantime, since creating this brief
1583440	1590380	and OpenAI forging ahead with its speed of technology now, that
1591360	1596600	characters that you get in and out has multiplied by a factor of I think like six or eight. It's
1596600	1605400	huge number of... a huge token limit now. Yeah, so now that's an example up there of
1605400	1611900	the kind of things I was asking. I was like, okay, so hey, this data set that I have is a huge list
1611900	1617680	of... it's a play of people who are preparing to go to a hacking conference. Some people in
1617680	1621840	there are really awesome, saying really positive things. And some people in there are kind of like
1621840	1630040	exhibiting narcissistic or psychopathic kind of like traits. Give me a list of the top five.
1630160	1637580	And it was just like an instant. There you go. Here's your five top targets, which was sweet.
1639560	1645760	I was like, okay, so in the data, give me a list of users that are suggesting the propensity
1645760	1653490	to commit crimes. Show me where they live. It wasn't actually showing me where they live,
1653490	1657870	but it was sort of saying like show me all the users that talk about a town name, city name,
1657870	1661510	or anything like that. So if you can imagine comparing to back when I was previously just
1661510	1665430	using Python to search through, I would have had to look through in terms of like a dictionary
1665430	1670590	search of every single town, every single place. But obviously, yeah, you know,
1670590	1674490	just knows and goes, here are all the people that say where they live.
1679020	1687670	Show me users that suggest fear. Yeah, this is an interesting one. Show me for a specific user
1687670	1692810	over the last 10 years, when they're online, when they make their posts.
1698280	1702580	And finally, I was like, show me anyone who's looking for anything, who has posted anything
1702580	1712710	about working on anything special or out of the ordinary at their work. Yeah, so I guess the
1712710	1720190	concept of the speech that I'm trying to get across is that the barriers of entry are completely
1720190	1725530	gone. All those questions that I was asking in the beginning of how am I going to do it?
1726170	1729690	You know, what even search terms am I looking for? What comments? What about things that don't
1729690	1737570	match the terms? How do I do it at scale? Where is it centralised? And when to do it? All of that
1737570	1743150	stuff is completely gone because of all of these things that make up what we would consider like
1743150	1751010	the capabilities required to do that. They're all inherent and anyone here can literally go online
1751010	1757930	and do online targeting of people with absolutely no experience whatsoever.
1761770	1765510	Yeah, in some of my rehearsals, someone was like, oh, can't you TP4 just do this now? Like,
1765510	1768530	you use plugins that you can just connect to the internet and you can just do it.
1768530	1773930	But unfortunately, it's quite resistant to this kind of these kind of questions.
1774130	1781470	No matter how hard I tried, TP4 is not happy to do it. So, you know, getting the data,
1781470	1784530	saving the data down, getting it offline, putting it onto your computer,
1784530	1795140	and then using the prompts to scan through it, much more successful. And now,
1796340	1800980	let's talk about, I think I've got like five or six target packs here that I'm going to talk
1800980	1806280	through. Before I start, I just want to have to make a few caveats to the things that we're
1806280	1813340	going to look at. Certainly, this is not a representation of DEF CON attendees at all,
1813340	1817140	like just like, you know, any subreddit, anyone in the world can join up.
1817440	1823720	I think it has like 30,000 members. So it's definitely not a representation of you guys here
1823720	1835340	today. What were the other... one second, sorry. Had some very important caveats I wanted to make.
1836180	1840960	Oh yeah, sorry. So the people who are up here obviously have their own, make their own decisions,
1840960	1844840	they have their own threat model, their own thresholds of like what they want to reveal
1844840	1852080	online. They probably have their own understanding of like how much they have revealed. Oh yeah,
1852080	1856020	and one other thing is on the fly out over here. I had a lot more information on these slides about
1856020	1861880	what people had posted. But I had kind of like a moment of clarity where I was like, well,
1861880	1867780	you know, if I put up any one thing that they've revealed, that kind of reveals everything. So I
1867780	1874540	did a lot, a lot of blurring on the way over here. So I apologize if it's a little too blurry for
1874540	1881160	the kind of blood that you wanted to see. But you know, people's privacy also in an area like this
1881160	1890000	is important. Anyway, let's get on with it. So the first guy or girl,
1890000	1894820	the AI hit four email addresses containing first name, last name.
1895360	1899920	I wanted to see talk about any illegal activity. I asked it to find comments about suffering
1900660	1907240	and also any kind of, you know, device information or models of modems and things like that.
1907240	1910480	So the first person, you know, quite a lot of hits here.
1911340	1917560	Router brand model, drug use. You know, I'm not here to pass judgment on anyone using drugs or
1917560	1924080	whatever. But you know, if you are going to post that in an online forum, you know, with all kinds
1924080	1929660	of actors looking at you, judging whether you're a target, and you're going to kind of reveal that
1929660	1936700	there are moments of vulnerability about your life, that could be a valuable data point.
1937280	1941800	This person's right into conspiracies, you know, very easily manipulated, I would imagine.
1942840	1948640	Crypto bro, yep. And the other thing was, yeah, so like, one thing if you think about like,
1948640	1955000	malicious actors trying to contact people or trying to like, have a pathway to conversation,
1955000	1958320	they might have to choose between a bunch of like, their hobbies or interests.
1958840	1963380	You know, a shortcut or a cheat code to that is like, if they're actually seeking a mentor. So
1963380	1969200	this person, you know, not too much here, but quite a lot of attack pathways.
1973090	1978110	Yeah, so this one, I actually pulled a lot down because this person was actually
1978110	1981110	posting a fair bit about themselves. But this one's going along the lines of like,
1981110	1987410	that's the stalker kind of threat. So the individuals posted, you know, their home location,
1987410	1993210	where they live, but also, you know, their name, age, backstory, quite a painful past,
1993210	1999610	lots of like, experiences of racism, things like that, that an attacker could look kind of
1999610	2003490	used to build rapport. But the other thing they mentioned was they're traveling alone
2003490	2009990	to DEF CON. And was, we're going to be at location ABC, you know, and if you're,
2009990	2014230	you know, a female traveling alone, and you're going to reveal everything about yourself and
2014230	2020370	your backstory, as well as, you know, positive ID of what you look like, it's quite a lot of stuff
2021070	2027190	for us quite a lot of sort of opportunities for someone who's trying to, you know, go after you to
2027190	2036230	to have, you know, in their back pocket. Yeah, this one's interesting one. So this one,
2036230	2041150	ChachiPT hit for weekend activities, small towns and use their first name. So it wasn't a lot of
2041150	2046750	things. But you know, after I kind of was like triaging through, this is kind of like a very
2048150	2052590	efficient and minimalist kind of pathway to an attack. So if you're going to talk about the city
2052590	2056510	or state that you live in, particularly this one, I think that the population was like under
2056510	2062630	100,000. But also talk about a place of interest that you and your family visit on a frequent basis.
2062770	2068550	And finally, talk about your vehicle description, right down to, you know, decals and stickers on
2068550	2072890	the back of it. If someone, you know, had that kind of information, they wanted to sort of get
2072890	2079610	close to you or get close to your house. It's all they would really need to target you from
2079610	2087830	an individual perspective. Yep. Breed of pet. Sure. Some of the slides have that kind of stuff
2087830	2092670	in there. Not just talking about, you know, those standard don't do security things like tell people
2092670	2100150	your secret questions. But if you're going to talk about your breed of pet, I think this is like the
2100150	2107130	French Bulldogs. Something to do with like every pet I've seen in DEF CON is French Bulldogs.
2107590	2110530	But if you're going to talk about that, you know, you're opening yourself up to pretty
2110530	2115610	effective spear phishing and things like that. Person's also very open to online comms.
2119780	2125960	Yeah, so this guy hit for got a security clearance. I live in X location and ranks. So this is a
2125960	2133500	military person, you know, posted to a certain location, revealing their career goals. You know,
2133500	2137400	if the attacker is thinking about, you know, everyone has something that they want or that
2137400	2140720	they're going after, if you're going to reveal your goals, that's kind of like an easy kind of
2140720	2148460	offering for you. Talk about their career timeline, grievances at work, military rank, and their
2148460	2155900	workplace and their openness and their kind of like approach to authority. So quite a lot of
2155900	2161180	stuff here. I realised in America, you guys have a little bit of different approach to how you
2161180	2169420	conceal security clearances and things like that. In Australia, it's fairly, it's just very
2169420	2173760	different. It's a different approach to how you manage your security clearance.
2178860	2183700	Yeah, so this one had quite a fair bit. So I was looking for, I found things for
2183700	2190140	gain seniority, specific device specifications, and things that they were struggling with.
2190140	2196260	So, you know, the AI found a quite a lot of things across the post from this person,
2196260	2203840	particularly the pet name, breed, became a senior manager quite quickly. If anyone here is, you know,
2203840	2208960	just to expand on that a little bit, I imagine that probably people here who work for companies
2208960	2213380	that have, you know, significant IP that they want to protect, or maybe you want to work one day for
2213380	2218660	companies that have IP they want to protect, you know, moving up in management in those companies
2219220	2223120	is probably something that an attacker would be looking for if they're trying to assess your
2223120	2229180	ability, what kind of stuff you know about that company. Yeah, revealing router brand model. I'm
2229180	2234340	not 100% sure how bad that is. You guys would probably tell me. Personal demons, where they
2234340	2239260	live, and also painful past. The person experienced quite a lot of bullying, and particularly the
2239260	2245080	number of posts with regards to this was pretty high. So, you know, in terms of like building
2245080	2249000	rapport and kind of like getting alongside this person, I would imagine that, you know,
2249000	2254680	an advanced attacker would probably have a pretty good chance from that angle.
2256420	2259580	And last but not least, yeah, this is probably one of my favourites.
2260020	2268140	This guy posted one time in the entire 18 years of the subreddit. Posted one time,
2268140	2275180	first name, last name at whatever.com. And I just googled that. And straight up,
2275180	2281160	pitches himself at work, ID card. You know, I'm not assuming that this is any kind of like high
2281160	2286480	security area, and that this is a massive security breach. But you know, if you only just go over to
2286480	2290820	the to the physical village, you can probably you can get some information about like, just having
2290820	2296040	the picture of the ID card usually will get you like you can create an imitation ID card. That's
2296040	2304120	like a pretty good bit of information to have if you're trying to get into a facility. So yeah,
2304120	2315540	don't post pictures of your ID card. Yeah, so those individual target packs only revealed
2317540	2325520	small things individually, what five or six different things. But I kind of encourage you
2325520	2329780	to kind of think about your own social media, not just your Reddit posts, but every other social
2329780	2336660	media that you use. And think about whether, you know, you had more than or accumulated measures,
2336660	2342580	accumulated version of those target packs, and how much information a person would have if they
2342580	2349260	were to just use something like AI, spend a bit of time and create, you know, create a target
2349260	2356960	pack surrounding you or, you know, individuals that you love or colleagues. This isn't a real
2356960	2363760	person, that's an AI guy. But yeah, that's the end of the speech. Does anyone have any questions?
2375930	2381310	So did you validate the data that you get it from chatJPT?
2381310	2387530	So is it real? Is the data in the data set or chatJPT just imagined it?
2389650	2394090	Sorry, I think I understood your question. You're saying, did I validate whether it was accurate,
2394090	2401510	what it was finding versus... yeah, so as you sort of saw in some of those slides, had like what
2402030	2407590	the output of the search was in like the black terminal kind of section. But then I went back
2407590	2414050	on to Reddit to kind of grade screenshots, make it a bit more user-friendly in terms of a speech.
2414050	2420850	I did go back, had a look at what the comment was in context, and that kind of, but you know,
2420850	2425430	it just added to the amount of time that I had to spend doing it. But yeah, that required human
2426130	2434630	interaction. It was not really possible to just have it completely automated. Does that answer
2434630	2452190	your question? Any others? Okay, yeah. So the question was, what was the most common leak that
2452190	2461520	you saw over and over again? Yeah, so these are like, I chose these because they're like the best
2461520	2470580	ones up there for kind of like a broad spectrum of things that people were leaking. Didn't see
2470700	2475780	a lot of like personal names. Like I was saying at the start, the DEF CON subreddit was actually
2475780	2481440	pretty hard to do. Like some of the other ones that I was looking at, like r slash cringe and r
2481440	2487940	slash NFL. Like I was just sort of like wanting to see how bad this subreddit was versus others,
2487940	2493820	and it was really good. So it was very difficult to find much information in there. I know it looks
2493820	2497020	like those few slides, there was lots, but I probably had something in the realm of like
2499760	2505820	maybe 20 or 30, which I thought would be a good starting point. And probably, yeah,
2505820	2510440	wasn't a lot of like first names, a lot of last names, almost zero like addresses,
2510440	2516940	actual addresses. There was just lots, and I think that the PII thing was probably fairly
2516940	2521540	covered by people. I think most people understand and not put those kind of like actual facts about
2521540	2527620	yourself in there. But the thing I did see posting over and over again was like,
2527620	2533100	yeah, personal, like sort of like own feelings, own mental state. Last thing I wanted to mention
2533100	2541320	actually, like the mental health slide, the mental health, I think it was like one of the
2541320	2546560	first or second slides had someone was discussing their like mental status. It was kind of like a
2547140	2551920	really, that was a difficult one for me. I was a bit conflicted about whether to put that up there
2552140	2557940	because a lot of people use talking about that kind of stuff in a forum to kind of like help
2557940	2565460	them get through it. But you know, particularly if you're thinking, if you believe you have a
2565460	2571200	high threat model, you know, revealing that kind of stuff to the entire world that you are
2571200	2577580	potentially compromised in different areas, you know, it does open you up to being manipulated
2577580	2582140	in that way or being attacked in that way. But yeah, I can't think off the top of my head,
2582140	2586440	apologize, what like the most frequent one was. Maybe that's a good thing to do next,
2586440	2591920	kind of like work out where the where the worst, where the worst leaks are happening. Thanks, sir.
2595110	2599730	I had a question about like fact checking. So especially on Reddit, sometimes people like to
2599730	2603350	role play as different things in different subreddits. And you'll see people on one forum
2603350	2607610	saying, Oh, I'm a software engineer, in a different thread, they'll say, Oh, I'm an auto
2607610	2611870	mechanic. And they might not be either, but they want to participate in these threads.
2611910	2616250	Is there a way that you've kind of vetted information sharing as
2617030	2621270	face fake or true information? Yeah, that's a good question. So
2624270	2628630	sort of manually, like manually, what people will do if they're like, if they're calling
2628630	2631830	bullshit on a person, they'll just sort of go to the user and look at all the other,
2631830	2638250	look at all the other posts that are in and go through. Do it using this to do it, I imagine
2638250	2643090	it'd be pretty easy. Like, you know, I was only distilled down to that DEF CON subreddit. So the
2643090	2654310	sorry, the prompt was only focused directly on that text file. But if you were to compile a
2654310	2658450	bunch of, you know, when you download that torrent, it was just like, which, which, you know,
2658450	2662210	it's like one and a half terabyte, I wasn't gonna download it all, just downloaded the ones that I
2662210	2667650	wanted to. But if you, I'd imagine this would be how I would go about it. Again, not a big,
2667650	2671750	not a data guy. But this is how I would do it. Go to the person, find all the ones that they're in.
2672250	2679030	And, yeah, go get that text file, put it all together, and then ask it questions about things
2679030	2684550	like job, things like experience. And, you know, from the results I got, it is fairly capable in
2684550	2689310	doing that and looking through and finding examples of that kind of stuff. But yeah,
2689310	2692170	not I didn't, I didn't actually do it. But thanks. Yeah.
2692990	2698650	I was wondering, when you found yourself moving from Reddit to other platforms,
2698650	2703950	could you rank the platforms, which ones people share the most information about themselves on?
2704610	2711050	Okay, yeah. So I didn't search through Discord or the forums, just because Discord hates being
2711050	2717910	scraped. And the forums, I didn't actually find that much, you know, actual information in there.
2719070	2722750	So yeah. No. Yeah. Thanks.
2725010	2728750	All right. I've been given a couple of minutes warning wrap up if there's any one or two
2728750	2732810	questions left. Otherwise, thanks very much. Been an awesome audience.