[00:00.000 --> 00:06.820] Good morning everyone and welcome to the village talk area. I am Tony, or ToughNuts. We're with [00:06.820 --> 00:12.240] the Packing Hacking Village. We are just across the way. Come, please, and visit us. And it is [00:12.240 --> 00:17.720] my great pleasure to introduce Will, who is going to be talking about some stuff you've found [00:17.720 --> 00:23.560] about leakage of data in social media. So, without much to do, if I could get everyone to [00:23.560 --> 00:36.720] please sit down. Hold on, D9. Can you? There we go. And Will, with that, thank you very much. [00:36.720 --> 00:48.200] Here you go. Hi. Could I get a show of hands in the audience, those of you who use Reddit? [00:49.560 --> 00:56.560] Awesome. Keep your hand raised if you subscribe to the DEF CON subreddit. Good. And one last [00:56.560 --> 01:03.540] question. Of those few, keep your hand raised if you post or comment to the DEF CON subreddit. [01:05.100 --> 01:12.180] Not too many, just one. All right, that's okay. Yeah, I was hoping for a few more, but that's okay. [01:12.180 --> 01:17.440] None of them are here. We can talk as much as we want about them. Yeah, so you've probably read [01:17.440 --> 01:24.080] the program. This talk is about me spending the last 12 months, call it what it is, stalking the [01:24.080 --> 01:30.500] DEF CON subreddit, seeking people's personal information that they might be leaking online. [01:31.460 --> 01:38.820] So, yeah, thanks for coming. Language warning, maybe. Information warning, definitely. [01:39.380 --> 01:44.120] Particularly anyone who had their hand raised in the last couple of questions, there is a small [01:44.120 --> 01:51.140] chance that you individually may be on these slides in the next 45 minutes or so. But don't freak [01:51.140 --> 01:57.640] out. I've done my due diligence. There's plenty of black text all over the slides, so you probably [01:57.640 --> 02:05.440] wanted to recognise yourself. Yeah, I just wanted to say before I started as well, this is meant to [02:05.440 --> 02:11.440] be a no prior knowledge required speech, so if you have any questions, can we just leave them [02:11.440 --> 02:20.640] till the end, and I'm happy to answer them after that. Let's get on with it. Yeah, obligatory intro [02:20.640 --> 02:28.720] slide. My name's Will. I'm from Australia. I work for a cyber security firm there. My day job is [02:28.720 --> 02:36.940] actually not related to this at all. I work in cyber security in the supply chain. So if you're [02:36.940 --> 02:41.280] looking through the brief and you're wondering what the hell has this got to do with that, [02:41.280 --> 02:48.540] you'd be 100% right. It has nothing to do with it. And also, yeah, I guess when I started as well, I [02:48.540 --> 02:58.260] had almost none of the skills required and probably still don't to do this kind of thing. I'm not a [02:58.260 --> 03:05.000] coder. Pretty shit at code. I'm not a social engineer. And you probably get that from my shitty dad [03:05.000 --> 03:12.140] jokes and my poor taste in memes. And I'm certainly not a data scientist. I have no ability to wrangle [03:12.140 --> 03:20.600] large data sets. So yeah, if you're in the audience and you are professional in any of those areas, I [03:20.600 --> 03:28.640] apologize in advance. I'll probably butcher your fields of expertise and misrepresent entirely. But [03:28.640 --> 03:38.010] yeah, I just, I didn't have any of that stuff and just had a crack at it anyway. So this is my [03:38.010 --> 03:43.810] second DEF CON. I came here last year as like a bucket list thing with a few friends. We went and [03:43.810 --> 03:48.470] visited the wall of sheep. If you haven't been there, I recommend doing it at some point in the [03:48.470 --> 03:53.450] conference. And we love the idea of like a practical way of kind of showing people what they [03:53.450 --> 03:59.830] were leaking on a network, an unsecure network. And yeah, we thought that was an awesome idea. [03:59.830 --> 04:06.130] And like most things, after a few refreshing beverages, we kind of thought to ourselves, that's [04:06.230 --> 04:12.730] a really awesome idea. You know, during the conference, showing people over those four days, [04:12.730 --> 04:17.890] what kind of stuff they're leaking. But what about all the stuff that people are leaking 365 days [04:17.890 --> 04:25.710] of the year, sharing on social media, everything about themselves. And yeah, from there, we were [04:25.710 --> 04:31.270] like, wouldn't that be a cool way? Wouldn't that be a cool presentation to sort of collate all that [04:31.270 --> 04:36.830] information? And yeah, present it back in a kind of like wall of sheep online edition. So that's [04:36.830 --> 04:42.350] what we kind of came up. So this is what we're going to be talking about. What would a wall of [04:42.350 --> 04:48.290] sheep online edition look like? Starting with my most overconfident plans, you know, someone with [04:48.290 --> 04:54.490] no ability to do it, deciding to go and do it. Yeah, what even is a leak? Took a little bit of [04:54.490 --> 05:01.430] time to kind of like have to work that out. I had no idea what I was looking for or defining what [05:01.430 --> 05:07.030] that was going to be. I needed to learn the recon game. I had no kind of clue what was going on [05:07.030 --> 05:11.550] there. And then sort of like the rest of this talk is really just talking about how I started [05:11.550 --> 05:17.250] hunting and gathering and finding those people. And then I promise, if you sit through all that, [05:17.250 --> 05:23.810] the last few slides, we'll be talking about sort of the most juicy slide packs of people that I [05:23.810 --> 05:32.780] found. Yeah, so I was like, how hard could it be? You know, everyone knows people leak stuff online. [05:32.780 --> 05:38.260] Everyone knows people overshare all the time. Social media these days has us lulled into this [05:38.260 --> 05:44.160] idea that, you know, oversharing is what you should be doing on social media. So I was like, [05:44.160 --> 05:50.020] I'll just find some target group, come up with some things to look for and then, you know, [05:50.020 --> 05:55.780] manually sift through and just try to find interesting folks. And then shortlist those people [05:56.320 --> 06:01.400] and then monitor those juicier profiles. And that was kind of it from the beginning. I was like, [06:01.400 --> 06:07.100] you know, had no real grand plans to actually do a talk like this. It was actually just for shits [06:07.100 --> 06:12.120] and gigs in the sidelines. And then just sit and wait, essentially, see how long it took. [06:13.500 --> 06:16.680] And then at some point, we're like, oh, yeah, wouldn't it be awesome if we actually just went [06:16.680 --> 06:23.960] after the DEF CON community instead of just any random community for a few reasons. [06:24.860 --> 06:28.440] So as you're probably aware, if you are all those people who are in the DEF CON subreddit, there's [06:28.440 --> 06:35.480] also a whole bunch of other social media platforms that the DEF CON attendees like to use, such as [06:35.480 --> 06:42.980] the forum, such as the Discord, and yeah, and the Reddit group. So all of those things kind of [06:42.980 --> 06:47.480] is really helpful because they all have great history. There's heaps of discussion on there. [06:47.480 --> 06:50.240] There's all different types of people on there, different skill sets. [06:51.280 --> 06:56.580] And one really awesome thing about you hackers is you like to reuse your handle everywhere. So [06:56.580 --> 07:00.100] that was really good to kind of like just track people across those three different areas. [07:00.640 --> 07:07.460] And also it's on topic. But yeah, for the rest of the brief, though, I actually just focused on [07:07.460 --> 07:15.440] the subreddit. So yeah, where the hell do I start? I was like, it's one thing to sort of come up with [07:15.440 --> 07:20.520] this idea that wouldn't it be funny to scrape a whole bunch of social media, but without any kind [07:20.520 --> 07:26.620] of idea of what to do or where to find the information, what am I even looking for? I was [07:26.620 --> 07:37.200] kind of like in a bit of a pickle in terms of actually starting. So yeah, we're all kind of [07:37.200 --> 07:42.920] aware of what PII is, personal identifiable information. I was pretty full bottle on what [07:42.920 --> 07:48.620] that kind of meant, you know, your name, date of birth, social security number you guys have, [07:48.620 --> 07:52.160] all that kind of like basic stuff. I was pretty sure I could find that kind of thing. [07:52.380 --> 07:57.060] But what about all the other stuff that people leak in terms of like their own personal information? [07:58.020 --> 08:03.920] It was kind of a pretty wide scope and I didn't really have much direction as to how to sort of [08:03.920 --> 08:09.500] define it or where to find it or any kind of like ability to do that at that stage. [08:10.800 --> 08:16.700] Fortunately, back home at my company, I had a guy who's sitting right next to me [08:16.700 --> 08:27.000] who has a PhD in cognitive behaviour and sort of is a proper scientist regarding that. And he was [08:27.000 --> 08:32.800] actually researching at the time the tendencies, the language and the behavioural patterns of [08:32.800 --> 08:39.560] people preceding OPSEC incidents. And so I was like, Riley, tell me how to find this stuff [08:39.560 --> 08:45.820] or is there any manuals? Tell me how to like search for it. And he pointed me down the track [08:45.820 --> 08:51.620] of, you guys have some amazing resources here in America, your three-letter agencies like CIA, FBI, [08:52.680 --> 08:56.960] the National Centre for Counterintelligence all have really great [08:58.120 --> 09:01.560] manuals and doctrine online. And I was like, that's a really great place to start. [09:03.220 --> 09:07.220] And not, sorry, not forgetting the social engineering community here was a really awesome [09:07.220 --> 09:13.580] treasure trove of sort of ways to find individuals and sort of target individuals. So I used all that, [09:13.580 --> 09:20.280] all those kind of resources to kind of guide me in how I was going to find this other kind of [09:20.280 --> 09:27.120] information beyond PII. And yeah, I came to the, they were all sort of pointing to the idea that [09:27.120 --> 09:34.880] there are these sort of like vulnerable, sort of personal vulnerability traits or more easily [09:34.880 --> 09:41.300] manipulated life situations or sort of like leverageable information. Yeah, like, you know, [09:41.300 --> 09:47.420] the Russians call it kompromat. And I was like, ooh, kompromat. I think I'll add that to my list [09:47.420 --> 09:53.880] of things I'm looking for beyond the sort of normal names and addresses and things like that. [09:54.440 --> 09:59.880] And my kind of simple mind could sort of track that as a kind of like easy way for an attacker [09:59.880 --> 10:05.280] or a malicious actor to search for, you know, stuff to find like a soft target. So I was like, [10:05.280 --> 10:13.200] that, that makes sense. Yeah, so I came up with this idea or this term called PVI, [10:13.200 --> 10:19.460] personal vulnerability information, you heard it here first, as opposed to traditional PII. [10:20.140 --> 10:25.880] Traditional PII is just those like super basic attributes that we're all kind of aware of and [10:25.880 --> 10:34.340] that organizations and governments, government policy like to, or have in their, in their [10:34.340 --> 10:40.540] policies to protect. And your standard security awareness programs also have this stuff in it [10:40.540 --> 10:44.960] as well. It's mostly, you know, don't put this stuff online. But if you compare that to all the [10:44.960 --> 10:52.740] other stuff that are people leaking, and, you know, isn't necessarily protected by this [10:52.740 --> 10:57.900] legislation or policy, you kind of have to ask yourself, like, which one do I, which one would [10:57.900 --> 11:03.820] I prefer to see in a leak? And also, which one am I actually leaking myself all the time? [11:07.240 --> 11:12.640] See, I was beginning to see, I was beginning to learn that PII is sort of like just scratching [11:12.640 --> 11:20.080] the surface in terms of like online targeting of people. Yeah, and I was really realizing that [11:20.080 --> 11:26.340] like the real bad dudes out there are actually searching for people who maybe will leak rather [11:26.340 --> 11:31.900] than people who already have leaked. And so if you think about all those things on that original [11:31.900 --> 11:37.500] slide, I was talking about all those like PII versus PVI, all this stuff that you might be [11:37.500 --> 11:45.160] in the blue column over here, have this like, provides an attacker with options to target you. [11:47.720 --> 11:52.960] So I was like, who are these bad dudes who are using this kind of stuff? And in all of the [11:52.960 --> 11:57.080] research that I was doing, I was realizing that, you know, it's not just the usual suspects that [11:57.080 --> 12:01.680] we're talking about here. I'm not just talking about APTs and hacktivists. We've all heard the [12:01.680 --> 12:08.300] stuff about, you know, online radicalization of young jihadis and things like that, which [12:08.300 --> 12:15.200] actually also adding, you know, stalkers, jealous ex-partners, child predators, all of these other [12:15.200 --> 12:19.900] malicious actors online who are using the exact same methodology of trying to find vulnerable [12:19.900 --> 12:30.440] targets using the language that they're presenting online. Yeah, so I had the what. I was like, okay, [12:30.440 --> 12:34.740] that's great. I'll be searching for actual facts about people and then kind of like personality [12:34.740 --> 12:40.560] types, language use, and those kind of things. Now, how the hell do I find that stuff on, [12:40.560 --> 12:47.880] you know, large, large space of information? So if you've been working in cyber security for [12:48.320 --> 12:52.640] a minute, you'd be aware of the intrusion kill chain. Just wanted to put that up there. [12:52.900 --> 12:57.640] We are definitely in the reconnaissance phase here, just researching, identifying, [12:57.640 --> 13:02.220] and selecting targets. And I was kind of trying to work out like how I was going to do this. [13:02.220 --> 13:06.400] So I just decided to smoosh all this kind of like, all these different organizations, [13:06.400 --> 13:13.800] methodologies into one kind of, into one, like my plan. So use the CIA's [13:15.580 --> 13:22.100] methods of like spot assess and develop, and also mixed in a bit of like the military concept of [13:22.100 --> 13:28.480] find, fix, finish. And using those things, using those resources online, like, particularly want [13:28.480 --> 13:35.000] to add the Department of Justice has awesome annals of, you know, cases here in America, [13:35.000 --> 13:39.760] like they kind of document exactly how espionage cases unfolded and how those people were [13:39.760 --> 13:45.700] approached online. Yeah, and I came up with the idea of like find, fix, follow, which I realize [13:45.700 --> 13:53.900] is just, it's just pretty rudimentary, but sorry, fix, find, follow. So I fixed, chose the haystack, [13:53.900 --> 13:58.920] chose the DEF CON subreddit. I was going to find those people using those terms amongst [13:58.920 --> 14:05.820] the anonymous users, anonymous users, and then assess for leakage, leakability, and tag those [14:05.820 --> 14:11.200] people for monitoring. And really at this stage, I was just doing this pretty rudimentary, just [14:11.200 --> 14:18.040] control F, you know, finding, finding words. So it's pretty basic at this stage. [14:23.630 --> 14:27.390] Yeah, so sort of coming to the part where I started, started doing it. So I had to have [14:27.390 --> 14:33.110] some assumptions to start with, was deciding that like people who reveal in DEF CON, sorry, [14:33.110 --> 14:38.090] Reddit slash DEF CON will reveal elsewhere is a pretty basic kind of assumption. [14:39.430 --> 14:45.530] If you're not aware, the DEF CON Reddit is pretty small. It's pretty small traffic, low traffic, [14:45.530 --> 14:49.570] sorry, compared to other subreddits around there. And it's going to be a pretty small [14:49.570 --> 14:55.450] percentage of those users posts. So I was like, okay, if I find situations in that, [14:55.450 --> 14:59.490] I'm just going to track where else they're posting and try and find more information from that point. [15:00.470 --> 15:04.850] Yeah, people who reveal big things probably do small ones also. That's a no-brainer. [15:05.010 --> 15:11.610] There is going to be old information. It's very old, you know, it's not very old, but as years go by, [15:11.610 --> 15:15.790] there's going to be stuff where people have changed, changed the information that they're [15:15.790 --> 15:22.790] presenting. And of course, there will be deception because, you know, I realise you guys, you hackers [15:22.790 --> 15:29.850] are slippery bastards. So I was really just searching for things like I work for, my email [15:29.850 --> 15:36.430] address is, my name is, and I live in. I realise that's pretty amateur hour, but that's just kind [15:36.430 --> 15:45.250] of like the small brain position I was in to start with. Yeah, scraping was pretty slow, [15:45.250 --> 15:50.430] had limited results. I was really only finding one, two, three things and sort of just slowly [15:50.430 --> 15:55.290] plodding away. And I was limited to those keywords. Well, I'm not limited to those keywords, [15:55.290 --> 15:59.210] but I was limited by those keywords, just searching for those few things that I could think of as [15:59.210 --> 16:05.230] what would be good strings to search for. I wasn't finding the kind of stuff I was after. [16:05.230 --> 16:11.750] And at that stage, I was like, I'm not really hacking this. I'm really just pushing forward. [16:12.570 --> 16:18.250] But then, you know, GPT entered the chat and I started to ask it to help me define those leaky [16:18.250 --> 16:24.050] or vulnerable language and really open up those keywords to much more things than I could consider [16:24.050 --> 16:31.470] as possible things I wanted to search for. And still some manual sifting needed then to, [16:31.470 --> 16:37.670] after I found those initial targets through posts. But those juicy individuals started to grow. [16:37.670 --> 16:42.870] At this stage, I think I had like two or three people with one or two little posts where I was [16:42.870 --> 16:50.970] like, okay, I think I'm starting to develop something here. And yeah, so if you've used [16:50.970 --> 16:57.010] chat GPT in the past or currently, you probably know it does require a bit of sort of convincing [16:57.010 --> 17:02.090] to get it going. I had to kind of convince it I was reviewing my own chat logs, make sure I wasn't [17:02.090 --> 17:06.550] revealing any personal information. And I was quite happy to come up with, you know, things that I [17:06.550 --> 17:13.510] should be looking for to try and find PII and PVI. And I was like, awesome. But can you give me [17:13.510 --> 17:18.250] the sort of like words that might precede a leak? That would be a bit more helpful than just giving [17:18.250 --> 17:24.510] me the concept of the kind of things that people are looking for. Yeah, and I was like, okay, can [17:24.510 --> 17:29.550] you give me a hundred different versions of that? Which was really helpful because then I could [17:29.550 --> 17:34.910] sort of just still doing my control F, still looking through. At some stage, I discovered [17:34.910 --> 17:41.590] there's like a year ago, it was still functioning, was a push shift IO, which is like a website we [17:41.590 --> 17:49.150] can do live queries of Reddit data. And I was just really just mandrolically going through [17:49.150 --> 17:53.570] and inserting these keywords in there and trying to search and then going back onto the subreddits [17:53.570 --> 17:59.570] trying to find the information. It was still very, very clunky. As you can imagine, some of [17:59.570 --> 18:04.650] these keywords, some of these sort of preceding strings aren't exactly the kind of language that [18:04.650 --> 18:10.550] people are using in the DEF CON subreddit. I received an email from, it's just not the [18:10.550 --> 18:18.940] language that's really in there. But I was finding some stuff here and there. Yeah, everything was [18:18.940 --> 18:25.300] going pretty great until, if you're a user of Reddit or if you're aware, Reddit halfway [18:25.300 --> 18:29.760] through last year or halfway through this year just decided to cut all access to third-party apps [18:29.760 --> 18:37.920] and my super powerful search tool just kind of went dark. And I was left sort of... motivation [18:37.920 --> 18:44.040] died, regretted not finishing earlier, not producing any slides because I had already [18:44.040 --> 18:50.100] actually sent this presentation to DEF CON. So I was like, had nothing. And I was kind of like, [18:50.100 --> 18:54.420] six weeks of just like, whatever. It was a smart idea. Well, I thought it was a smart idea to begin [18:54.420 --> 19:04.380] with. And I was like, it's probably not going to be possible now. But then, from total failure, [19:04.680 --> 19:12.560] I realised that some saint had been archiving Reddit data since the beginning of time. So [19:12.560 --> 19:18.720] there was literally every single post, every single comment that had ever been made in Reddit [19:18.720 --> 19:27.520] in one gigantic text file. And so I was like, sweet. 50,000 comments, 6,000 posts. Now I wasn't [19:27.520 --> 19:34.920] just looking at the last 12 months. I had 18 years worth. The Reddit... sorry, the DEF CON Reddit [19:34.920 --> 19:40.640] doesn't go back that far. But now I was really just looking at a decade's worth of comments, [19:40.640 --> 19:47.240] which gave me a much more big... sorry, a much larger data set to look through. [19:50.560 --> 19:55.860] Yeah, sorry. So at that stage, I was... yeah, so I'm... sorry, it's kind of... [19:57.840 --> 20:00.980] one of the problems with doing one of these briefs is you've got to remember what you were doing 12 [20:00.980 --> 20:07.160] months ago. Now I was working with a text file. So now I'm just really just searching through a text [20:07.160 --> 20:13.500] file, you know, using Python to just search for strings within the text file, rather than looking [20:13.500 --> 20:21.600] on Reddit online, using the search. But yeah, at some point during the year, I was listening to [20:21.840 --> 20:27.200] a Darknet Diaries episode, big Darknet fan. And I was listening to Sam Bent, who he presented last [20:27.200 --> 20:34.000] year at DEF CON. He was talking about how he was using... he was trying to circumnavigate the [20:34.720 --> 20:39.240] US Postal Service to send drugs through the mail. And he was trying to work out how he was going to [20:39.240 --> 20:43.600] do it. And he was like, well, one of the, you know, one of the things, best things about the [20:43.600 --> 20:49.040] Postal Service is they have a manual online for what good looks like, what they're searching for. [20:49.040 --> 20:54.100] And he was like, I'll just do the opposite. And I was driving along, I was like, I think I could [20:54.100 --> 21:02.240] just do the opposite. So I went online to the Australian government website to try and find like [21:02.240 --> 21:06.840] the kind of attributes that they are looking for when they're trying to give people [21:06.840 --> 21:10.280] security clearances, or they're looking to give people security clearances. [21:10.560 --> 21:15.340] And I was looking for attributes for people in that sense, because I was like, well, that's good, [21:15.340 --> 21:21.180] that's safe. Those are the things that they think people will present as, you know, being able to [21:21.180 --> 21:27.460] keep a secret or being able to, you know, keep the nation's secrets. And I was like, hey, ChachiPT, [21:27.460 --> 21:33.960] give me all the synonyms for all of those things. And then also give me all the antonyms for all of [21:33.960 --> 21:39.200] those as well. So I came up with a huge list of antonyms of like the types of people that I was [21:39.200 --> 21:48.020] looking for online. And then I was like, find me all variations of that. So sort of like just [21:48.020 --> 21:54.020] punched out hundreds and hundreds of different sentences, which might suggest the type of person [21:54.020 --> 22:01.060] who presents those kind of characteristics. And yeah, now I really felt like I was cooking with [22:01.060 --> 22:05.100] gas, because I was not only searching for these things, I was searching for sort of permutations [22:05.100 --> 22:12.000] or variations of those, just little chunks of those. And I was really finding a lot of results [22:12.000 --> 22:19.600] using this method. Yeah, so I also wanted to find those leak facts. So thinking back to the [22:19.600 --> 22:25.760] beginning, I was also trying to find PII. So, you know, from a slow and sort of like noisy scrape, [22:26.120 --> 22:31.760] I was now using those kind of that, you know, GPT enhanced powerful semantic search to try and find [22:31.760 --> 22:37.900] words, which sort of seemed like the person was either going to leak or had leaked. The search [22:37.900 --> 22:45.300] method didn't change for using the PII. I just had to obviously assess the leak's impact. [22:45.300 --> 22:50.100] So some stuff that people are leaking is really just sort of basic stuff, like down in this green [22:50.100 --> 22:57.680] area. You know, I just put this together to try to like kind of visualise how I was assessing [22:57.680 --> 23:01.480] the kind of things that people are leaking. And it's kind of what I call this death by thousand [23:01.480 --> 23:07.640] likes, because lots of the stuff, sure, whatever, it's just online. But you know, when you add it [23:07.640 --> 23:14.740] all up, it really is and has an accumulative effect. Yeah, so I had to assess the impact, [23:14.740 --> 23:19.780] but also like the frequency. If you're, you know, if you have 500 comments in the sort of green, [23:19.780 --> 23:25.360] yellow area, maybe that's sort of only worth like one comment in the red area. There's still heaps [23:25.360 --> 23:31.460] of error, as you're probably aware. Chachipiti made a lot of things up a lot of the time and it was [23:31.460 --> 23:36.960] still very human-driven. I was still searching through and finding. I still had to go through [23:36.960 --> 23:41.020] and look through the results and actually kind of prove or disprove whether it was [23:41.020 --> 23:48.060] actually what I was looking for. Yeah, as you can probably imagine, 18 years is a long time. [23:48.200 --> 23:52.820] I had lots of false positives, lots of like comments that people were making and I was just like, [23:52.820 --> 23:58.620] that's nothing. So that was taking quite a lot of my time. It was taking quite a lot of energy and [23:59.420 --> 24:03.840] it was pretty boring looking through lots and like hundreds of false positives. [24:03.920 --> 24:09.720] There's lots of non-repeat offenders. So like you might make one mistake like one time 10 years ago [24:10.320 --> 24:14.500] and post something about yourself and I just sort of like wasn't interested in that. [24:15.440 --> 24:20.380] And there was lots of target drop-off as well. So like lots of the people I was looking at, [24:20.380 --> 24:23.880] lots of the results was happening a long time ago. Those people might have just like moved on [24:23.880 --> 24:27.340] and not even been into security anymore. So I kind of wasn't interested in that. [24:27.940 --> 24:31.780] The one thing I want to say about that is like it's only bad in this context, right? So I'm [24:31.780 --> 24:36.500] trying to find people, I'm trying to produce slides that are interesting for you guys to look at. [24:36.500 --> 24:42.120] If it's a malicious actor, if it's like those stalkers or predators or whatever or more advanced [24:42.780 --> 24:47.960] enemies where like you need to imagine like they only need one slip-up or one thing that [24:47.960 --> 24:53.700] they're looking for. So it's only bad in this context. Yeah, and today we're only going to [24:53.700 --> 24:58.020] look at high-quantity packs. I didn't really put anything together where someone had just made one [24:58.020 --> 25:06.280] slip. But I was also thinking now I'm actually, you know, now I've got big brain, big brain mode. [25:07.080 --> 25:11.260] And then, yeah, sort of like a couple of months ago, as you're probably aware, [25:12.360 --> 25:20.700] OpenAI gave us access to the API. So this was huge. I was like, whoa, god mode. I was now able [25:20.700 --> 25:26.380] to just plug the data, the massive text file of all of those comments straight into the ChatGPT [25:27.260 --> 25:36.960] prompt and just literally ask it questions about the data. Yeah, so as I said at the start, [25:36.960 --> 25:42.120] this is meant to be like a no prior knowledge brief and I certainly had no prior knowledge [25:42.120 --> 25:47.720] before I started it. But what it meant was I didn't have to produce any search scripts anymore. [25:48.220 --> 25:52.440] I was no longer in charge of coming up with creative versions of the kind of stuff I was [25:52.440 --> 26:01.120] looking for. I no longer needed to. Yeah, sorry I said that. I just left it all up to the large [26:01.120 --> 26:06.620] language model, which was awesome. It was really limited only by tokens. If you're not aware, [26:06.620 --> 26:11.480] when you're asking it questions, you are limited by a number of characters in and out. [26:11.480 --> 26:15.940] But that really only just slowed me down. I just had to like chunk up the data into smaller pieces [26:15.940 --> 26:23.440] and re-ask the questions over and over. And in the meantime, since creating this brief [26:23.440 --> 26:30.380] and OpenAI forging ahead with its speed of technology now, that [26:31.360 --> 26:36.600] characters that you get in and out has multiplied by a factor of I think like six or eight. It's [26:36.600 --> 26:45.400] huge number of... a huge token limit now. Yeah, so now that's an example up there of [26:45.400 --> 26:51.900] the kind of things I was asking. I was like, okay, so hey, this data set that I have is a huge list [26:51.900 --> 26:57.680] of... it's a play of people who are preparing to go to a hacking conference. Some people in [26:57.680 --> 27:01.840] there are really awesome, saying really positive things. And some people in there are kind of like [27:01.840 --> 27:10.040] exhibiting narcissistic or psychopathic kind of like traits. Give me a list of the top five. [27:10.160 --> 27:17.580] And it was just like an instant. There you go. Here's your five top targets, which was sweet. [27:19.560 --> 27:25.760] I was like, okay, so in the data, give me a list of users that are suggesting the propensity [27:25.760 --> 27:33.490] to commit crimes. Show me where they live. It wasn't actually showing me where they live, [27:33.490 --> 27:37.870] but it was sort of saying like show me all the users that talk about a town name, city name, [27:37.870 --> 27:41.510] or anything like that. So if you can imagine comparing to back when I was previously just [27:41.510 --> 27:45.430] using Python to search through, I would have had to look through in terms of like a dictionary [27:45.430 --> 27:50.590] search of every single town, every single place. But obviously, yeah, you know, [27:50.590 --> 27:54.490] just knows and goes, here are all the people that say where they live. [27:59.020 --> 28:07.670] Show me users that suggest fear. Yeah, this is an interesting one. Show me for a specific user [28:07.670 --> 28:12.810] over the last 10 years, when they're online, when they make their posts. [28:18.280 --> 28:22.580] And finally, I was like, show me anyone who's looking for anything, who has posted anything [28:22.580 --> 28:32.710] about working on anything special or out of the ordinary at their work. Yeah, so I guess the [28:32.710 --> 28:40.190] concept of the speech that I'm trying to get across is that the barriers of entry are completely [28:40.190 --> 28:45.530] gone. All those questions that I was asking in the beginning of how am I going to do it? [28:46.170 --> 28:49.690] You know, what even search terms am I looking for? What comments? What about things that don't [28:49.690 --> 28:57.570] match the terms? How do I do it at scale? Where is it centralised? And when to do it? All of that [28:57.570 --> 29:03.150] stuff is completely gone because of all of these things that make up what we would consider like [29:03.150 --> 29:11.010] the capabilities required to do that. They're all inherent and anyone here can literally go online [29:11.010 --> 29:17.930] and do online targeting of people with absolutely no experience whatsoever. [29:21.770 --> 29:25.510] Yeah, in some of my rehearsals, someone was like, oh, can't you TP4 just do this now? Like, [29:25.510 --> 29:28.530] you use plugins that you can just connect to the internet and you can just do it. [29:28.530 --> 29:33.930] But unfortunately, it's quite resistant to this kind of these kind of questions. [29:34.130 --> 29:41.470] No matter how hard I tried, TP4 is not happy to do it. So, you know, getting the data, [29:41.470 --> 29:44.530] saving the data down, getting it offline, putting it onto your computer, [29:44.530 --> 29:55.140] and then using the prompts to scan through it, much more successful. And now, [29:56.340 --> 30:00.980] let's talk about, I think I've got like five or six target packs here that I'm going to talk [30:00.980 --> 30:06.280] through. Before I start, I just want to have to make a few caveats to the things that we're [30:06.280 --> 30:13.340] going to look at. Certainly, this is not a representation of DEF CON attendees at all, [30:13.340 --> 30:17.140] like just like, you know, any subreddit, anyone in the world can join up. [30:17.440 --> 30:23.720] I think it has like 30,000 members. So it's definitely not a representation of you guys here [30:23.720 --> 30:35.340] today. What were the other... one second, sorry. Had some very important caveats I wanted to make. [30:36.180 --> 30:40.960] Oh yeah, sorry. So the people who are up here obviously have their own, make their own decisions, [30:40.960 --> 30:44.840] they have their own threat model, their own thresholds of like what they want to reveal [30:44.840 --> 30:52.080] online. They probably have their own understanding of like how much they have revealed. Oh yeah, [30:52.080 --> 30:56.020] and one other thing is on the fly out over here. I had a lot more information on these slides about [30:56.020 --> 31:01.880] what people had posted. But I had kind of like a moment of clarity where I was like, well, [31:01.880 --> 31:07.780] you know, if I put up any one thing that they've revealed, that kind of reveals everything. So I [31:07.780 --> 31:14.540] did a lot, a lot of blurring on the way over here. So I apologize if it's a little too blurry for [31:14.540 --> 31:21.160] the kind of blood that you wanted to see. But you know, people's privacy also in an area like this [31:21.160 --> 31:30.000] is important. Anyway, let's get on with it. So the first guy or girl, [31:30.000 --> 31:34.820] the AI hit four email addresses containing first name, last name. [31:35.360 --> 31:39.920] I wanted to see talk about any illegal activity. I asked it to find comments about suffering [31:40.660 --> 31:47.240] and also any kind of, you know, device information or models of modems and things like that. [31:47.240 --> 31:50.480] So the first person, you know, quite a lot of hits here. [31:51.340 --> 31:57.560] Router brand model, drug use. You know, I'm not here to pass judgment on anyone using drugs or [31:57.560 --> 32:04.080] whatever. But you know, if you are going to post that in an online forum, you know, with all kinds [32:04.080 --> 32:09.660] of actors looking at you, judging whether you're a target, and you're going to kind of reveal that [32:09.660 --> 32:16.700] there are moments of vulnerability about your life, that could be a valuable data point. [32:17.280 --> 32:21.800] This person's right into conspiracies, you know, very easily manipulated, I would imagine. [32:22.840 --> 32:28.640] Crypto bro, yep. And the other thing was, yeah, so like, one thing if you think about like, [32:28.640 --> 32:35.000] malicious actors trying to contact people or trying to like, have a pathway to conversation, [32:35.000 --> 32:38.320] they might have to choose between a bunch of like, their hobbies or interests. [32:38.840 --> 32:43.380] You know, a shortcut or a cheat code to that is like, if they're actually seeking a mentor. So [32:43.380 --> 32:49.200] this person, you know, not too much here, but quite a lot of attack pathways. [32:53.090 --> 32:58.110] Yeah, so this one, I actually pulled a lot down because this person was actually [32:58.110 --> 33:01.110] posting a fair bit about themselves. But this one's going along the lines of like, [33:01.110 --> 33:07.410] that's the stalker kind of threat. So the individuals posted, you know, their home location, [33:07.410 --> 33:13.210] where they live, but also, you know, their name, age, backstory, quite a painful past, [33:13.210 --> 33:19.610] lots of like, experiences of racism, things like that, that an attacker could look kind of [33:19.610 --> 33:23.490] used to build rapport. But the other thing they mentioned was they're traveling alone [33:23.490 --> 33:29.990] to DEF CON. And was, we're going to be at location ABC, you know, and if you're, [33:29.990 --> 33:34.230] you know, a female traveling alone, and you're going to reveal everything about yourself and [33:34.230 --> 33:40.370] your backstory, as well as, you know, positive ID of what you look like, it's quite a lot of stuff [33:41.070 --> 33:47.190] for us quite a lot of sort of opportunities for someone who's trying to, you know, go after you to [33:47.190 --> 33:56.230] to have, you know, in their back pocket. Yeah, this one's interesting one. So this one, [33:56.230 --> 34:01.150] ChachiPT hit for weekend activities, small towns and use their first name. So it wasn't a lot of [34:01.150 --> 34:06.750] things. But you know, after I kind of was like triaging through, this is kind of like a very [34:08.150 --> 34:12.590] efficient and minimalist kind of pathway to an attack. So if you're going to talk about the city [34:12.590 --> 34:16.510] or state that you live in, particularly this one, I think that the population was like under [34:16.510 --> 34:22.630] 100,000. But also talk about a place of interest that you and your family visit on a frequent basis. [34:22.770 --> 34:28.550] And finally, talk about your vehicle description, right down to, you know, decals and stickers on [34:28.550 --> 34:32.890] the back of it. If someone, you know, had that kind of information, they wanted to sort of get [34:32.890 --> 34:39.610] close to you or get close to your house. It's all they would really need to target you from [34:39.610 --> 34:47.830] an individual perspective. Yep. Breed of pet. Sure. Some of the slides have that kind of stuff [34:47.830 --> 34:52.670] in there. Not just talking about, you know, those standard don't do security things like tell people [34:52.670 --> 35:00.150] your secret questions. But if you're going to talk about your breed of pet, I think this is like the [35:00.150 --> 35:07.130] French Bulldogs. Something to do with like every pet I've seen in DEF CON is French Bulldogs. [35:07.590 --> 35:10.530] But if you're going to talk about that, you know, you're opening yourself up to pretty [35:10.530 --> 35:15.610] effective spear phishing and things like that. Person's also very open to online comms. [35:19.780 --> 35:25.960] Yeah, so this guy hit for got a security clearance. I live in X location and ranks. So this is a [35:25.960 --> 35:33.500] military person, you know, posted to a certain location, revealing their career goals. You know, [35:33.500 --> 35:37.400] if the attacker is thinking about, you know, everyone has something that they want or that [35:37.400 --> 35:40.720] they're going after, if you're going to reveal your goals, that's kind of like an easy kind of [35:40.720 --> 35:48.460] offering for you. Talk about their career timeline, grievances at work, military rank, and their [35:48.460 --> 35:55.900] workplace and their openness and their kind of like approach to authority. So quite a lot of [35:55.900 --> 36:01.180] stuff here. I realised in America, you guys have a little bit of different approach to how you [36:01.180 --> 36:09.420] conceal security clearances and things like that. In Australia, it's fairly, it's just very [36:09.420 --> 36:13.760] different. It's a different approach to how you manage your security clearance. [36:18.860 --> 36:23.700] Yeah, so this one had quite a fair bit. So I was looking for, I found things for [36:23.700 --> 36:30.140] gain seniority, specific device specifications, and things that they were struggling with. [36:30.140 --> 36:36.260] So, you know, the AI found a quite a lot of things across the post from this person, [36:36.260 --> 36:43.840] particularly the pet name, breed, became a senior manager quite quickly. If anyone here is, you know, [36:43.840 --> 36:48.960] just to expand on that a little bit, I imagine that probably people here who work for companies [36:48.960 --> 36:53.380] that have, you know, significant IP that they want to protect, or maybe you want to work one day for [36:53.380 --> 36:58.660] companies that have IP they want to protect, you know, moving up in management in those companies [36:59.220 --> 37:03.120] is probably something that an attacker would be looking for if they're trying to assess your [37:03.120 --> 37:09.180] ability, what kind of stuff you know about that company. Yeah, revealing router brand model. I'm [37:09.180 --> 37:14.340] not 100% sure how bad that is. You guys would probably tell me. Personal demons, where they [37:14.340 --> 37:19.260] live, and also painful past. The person experienced quite a lot of bullying, and particularly the [37:19.260 --> 37:25.080] number of posts with regards to this was pretty high. So, you know, in terms of like building [37:25.080 --> 37:29.000] rapport and kind of like getting alongside this person, I would imagine that, you know, [37:29.000 --> 37:34.680] an advanced attacker would probably have a pretty good chance from that angle. [37:36.420 --> 37:39.580] And last but not least, yeah, this is probably one of my favourites. [37:40.020 --> 37:48.140] This guy posted one time in the entire 18 years of the subreddit. Posted one time, [37:48.140 --> 37:55.180] first name, last name at whatever.com. And I just googled that. And straight up, [37:55.180 --> 38:01.160] pitches himself at work, ID card. You know, I'm not assuming that this is any kind of like high [38:01.160 --> 38:06.480] security area, and that this is a massive security breach. But you know, if you only just go over to [38:06.480 --> 38:10.820] the to the physical village, you can probably you can get some information about like, just having [38:10.820 --> 38:16.040] the picture of the ID card usually will get you like you can create an imitation ID card. That's [38:16.040 --> 38:24.120] like a pretty good bit of information to have if you're trying to get into a facility. So yeah, [38:24.120 --> 38:35.540] don't post pictures of your ID card. Yeah, so those individual target packs only revealed [38:37.540 --> 38:45.520] small things individually, what five or six different things. But I kind of encourage you [38:45.520 --> 38:49.780] to kind of think about your own social media, not just your Reddit posts, but every other social [38:49.780 --> 38:56.660] media that you use. And think about whether, you know, you had more than or accumulated measures, [38:56.660 --> 39:02.580] accumulated version of those target packs, and how much information a person would have if they [39:02.580 --> 39:09.260] were to just use something like AI, spend a bit of time and create, you know, create a target [39:09.260 --> 39:16.960] pack surrounding you or, you know, individuals that you love or colleagues. This isn't a real [39:16.960 --> 39:23.760] person, that's an AI guy. But yeah, that's the end of the speech. Does anyone have any questions? [39:35.930 --> 39:41.310] So did you validate the data that you get it from chatJPT? [39:41.310 --> 39:47.530] So is it real? Is the data in the data set or chatJPT just imagined it? [39:49.650 --> 39:54.090] Sorry, I think I understood your question. You're saying, did I validate whether it was accurate, [39:54.090 --> 40:01.510] what it was finding versus... yeah, so as you sort of saw in some of those slides, had like what [40:02.030 --> 40:07.590] the output of the search was in like the black terminal kind of section. But then I went back [40:07.590 --> 40:14.050] on to Reddit to kind of grade screenshots, make it a bit more user-friendly in terms of a speech. [40:14.050 --> 40:20.850] I did go back, had a look at what the comment was in context, and that kind of, but you know, [40:20.850 --> 40:25.430] it just added to the amount of time that I had to spend doing it. But yeah, that required human [40:26.130 --> 40:34.630] interaction. It was not really possible to just have it completely automated. Does that answer [40:34.630 --> 40:52.190] your question? Any others? Okay, yeah. So the question was, what was the most common leak that [40:52.190 --> 41:01.520] you saw over and over again? Yeah, so these are like, I chose these because they're like the best [41:01.520 --> 41:10.580] ones up there for kind of like a broad spectrum of things that people were leaking. Didn't see [41:10.700 --> 41:15.780] a lot of like personal names. Like I was saying at the start, the DEF CON subreddit was actually [41:15.780 --> 41:21.440] pretty hard to do. Like some of the other ones that I was looking at, like r slash cringe and r [41:21.440 --> 41:27.940] slash NFL. Like I was just sort of like wanting to see how bad this subreddit was versus others, [41:27.940 --> 41:33.820] and it was really good. So it was very difficult to find much information in there. I know it looks [41:33.820 --> 41:37.020] like those few slides, there was lots, but I probably had something in the realm of like [41:39.760 --> 41:45.820] maybe 20 or 30, which I thought would be a good starting point. And probably, yeah, [41:45.820 --> 41:50.440] wasn't a lot of like first names, a lot of last names, almost zero like addresses, [41:50.440 --> 41:56.940] actual addresses. There was just lots, and I think that the PII thing was probably fairly [41:56.940 --> 42:01.540] covered by people. I think most people understand and not put those kind of like actual facts about [42:01.540 --> 42:07.620] yourself in there. But the thing I did see posting over and over again was like, [42:07.620 --> 42:13.100] yeah, personal, like sort of like own feelings, own mental state. Last thing I wanted to mention [42:13.100 --> 42:21.320] actually, like the mental health slide, the mental health, I think it was like one of the [42:21.320 --> 42:26.560] first or second slides had someone was discussing their like mental status. It was kind of like a [42:27.140 --> 42:31.920] really, that was a difficult one for me. I was a bit conflicted about whether to put that up there [42:32.140 --> 42:37.940] because a lot of people use talking about that kind of stuff in a forum to kind of like help [42:37.940 --> 42:45.460] them get through it. But you know, particularly if you're thinking, if you believe you have a [42:45.460 --> 42:51.200] high threat model, you know, revealing that kind of stuff to the entire world that you are [42:51.200 --> 42:57.580] potentially compromised in different areas, you know, it does open you up to being manipulated [42:57.580 --> 43:02.140] in that way or being attacked in that way. But yeah, I can't think off the top of my head, [43:02.140 --> 43:06.440] apologize, what like the most frequent one was. Maybe that's a good thing to do next, [43:06.440 --> 43:11.920] kind of like work out where the where the worst, where the worst leaks are happening. Thanks, sir. [43:15.110 --> 43:19.730] I had a question about like fact checking. So especially on Reddit, sometimes people like to [43:19.730 --> 43:23.350] role play as different things in different subreddits. And you'll see people on one forum [43:23.350 --> 43:27.610] saying, Oh, I'm a software engineer, in a different thread, they'll say, Oh, I'm an auto [43:27.610 --> 43:31.870] mechanic. And they might not be either, but they want to participate in these threads. [43:31.910 --> 43:36.250] Is there a way that you've kind of vetted information sharing as [43:37.030 --> 43:41.270] face fake or true information? Yeah, that's a good question. So [43:44.270 --> 43:48.630] sort of manually, like manually, what people will do if they're like, if they're calling [43:48.630 --> 43:51.830] bullshit on a person, they'll just sort of go to the user and look at all the other, [43:51.830 --> 43:58.250] look at all the other posts that are in and go through. Do it using this to do it, I imagine [43:58.250 --> 44:03.090] it'd be pretty easy. Like, you know, I was only distilled down to that DEF CON subreddit. So the [44:03.090 --> 44:14.310] sorry, the prompt was only focused directly on that text file. But if you were to compile a [44:14.310 --> 44:18.450] bunch of, you know, when you download that torrent, it was just like, which, which, you know, [44:18.450 --> 44:22.210] it's like one and a half terabyte, I wasn't gonna download it all, just downloaded the ones that I [44:22.210 --> 44:27.650] wanted to. But if you, I'd imagine this would be how I would go about it. Again, not a big, [44:27.650 --> 44:31.750] not a data guy. But this is how I would do it. Go to the person, find all the ones that they're in. [44:32.250 --> 44:39.030] And, yeah, go get that text file, put it all together, and then ask it questions about things [44:39.030 --> 44:44.550] like job, things like experience. And, you know, from the results I got, it is fairly capable in [44:44.550 --> 44:49.310] doing that and looking through and finding examples of that kind of stuff. But yeah, [44:49.310 --> 44:52.170] not I didn't, I didn't actually do it. But thanks. Yeah. [44:52.990 --> 44:58.650] I was wondering, when you found yourself moving from Reddit to other platforms, [44:58.650 --> 45:03.950] could you rank the platforms, which ones people share the most information about themselves on? [45:04.610 --> 45:11.050] Okay, yeah. So I didn't search through Discord or the forums, just because Discord hates being [45:11.050 --> 45:17.910] scraped. And the forums, I didn't actually find that much, you know, actual information in there. [45:19.070 --> 45:22.750] So yeah. No. Yeah. Thanks. [45:25.010 --> 45:28.750] All right. I've been given a couple of minutes warning wrap up if there's any one or two [45:28.750 --> 45:32.810] questions left. Otherwise, thanks very much. Been an awesome audience.