WEBVTT 00:00.000 --> 00:04.700 Good morning everyone and welcome to the village talk area. 00:04.700 --> 00:06.480 I am Tony, or ToughNuts. 00:06.480 --> 00:08.080 We're with the Packing Hacking Village. 00:08.080 --> 00:09.220 We are just across the way. 00:09.220 --> 00:11.280 Come, please, and visit us. 00:11.480 --> 00:19.880 And it is my great pleasure to introduce Will, who is going to be talking about some stuff you've found about leakage of data in social media. 00:19.880 --> 00:25.100 So, without much to do, if I could get everyone to please sit down. 00:25.520 --> 00:26.820 Hold on, D9. 00:28.340 --> 00:29.260 Can you? 00:31.940 --> 00:34.040 There we go. 00:34.040 --> 00:36.720 And Will, with that, thank you very much. 00:36.720 --> 00:37.640 Here you go. 00:39.800 --> 00:40.840 Hi. 00:43.580 --> 00:48.200 Could I get a show of hands in the audience, those of you who use Reddit? 00:49.560 --> 00:50.240 Awesome. 00:50.240 --> 00:53.900 Keep your hand raised if you subscribe to the DEF CON subreddit. 00:55.300 --> 00:55.960 Good. 00:55.960 --> 00:57.460 And one last question. 00:58.180 --> 01:03.540 Of those few, keep your hand raised if you post or comment to the DEF CON subreddit. 01:05.100 --> 01:06.860 Not too many, just one. 01:06.860 --> 01:08.140 All right, that's okay. 01:09.760 --> 01:12.180 Yeah, I was hoping for a few more, but that's okay. 01:12.180 --> 01:12.900 None of them are here. 01:12.900 --> 01:14.720 We can talk as much as we want about them. 01:16.120 --> 01:18.080 Yeah, so you've probably read the program. 01:18.080 --> 01:30.500 This talk is about me spending the last 12 months, call it what it is, stalking the DEF CON subreddit, seeking people's personal information that they might be leaking online. 01:31.460 --> 01:32.980 So, yeah, thanks for coming. 01:33.420 --> 01:35.460 Language warning, maybe. 01:36.060 --> 01:38.820 Information warning, definitely. 01:39.380 --> 01:49.560 Particularly anyone who had their hand raised in the last couple of questions, there is a small chance that you individually may be on these slides in the next 45 minutes or so. 01:50.500 --> 01:51.800 But don't freak out. 01:52.120 --> 01:54.740 I've done my due diligence. 01:55.100 --> 01:59.160 There's plenty of black text all over the slides, so you probably wanted to recognise yourself. 02:02.520 --> 02:15.000 Yeah, I just wanted to say before I started as well, this is meant to be a no prior knowledge required speech, so if you have any questions, can we just leave them till the end, and I'm happy to answer them after that. 02:15.660 --> 02:17.700 Let's get on with it. 02:19.240 --> 02:21.380 Yeah, obligatory intro slide. 02:21.380 --> 02:22.520 My name's Will. 02:22.620 --> 02:24.080 I'm from Australia. 02:24.520 --> 02:27.380 I work for a cyber security firm there. 02:27.680 --> 02:31.840 My day job is actually not related to this at all. 02:31.840 --> 02:35.160 I work in cyber security in the supply chain. 02:35.840 --> 02:42.800 So if you're looking through the brief and you're wondering what the hell has this got to do with that, you'd be 100% right. 02:42.920 --> 02:44.600 It has nothing to do with it. 02:46.280 --> 02:55.680 And also, yeah, I guess when I started as well, I had almost none of the skills required and probably still don't to do this kind of thing. 02:56.340 --> 02:58.700 I'm not a coder . 02:58.780 --> 03:00.120 Pretty shit at code. 03:00.160 --> 03:02.000 I'm not a social engineer. 03:02.760 --> 03:08.160 And you probably get that from my shitty dad jokes and my poor taste in memes. 03:08.160 --> 03:09.900 And I'm certainly not a data scientist. 03:09.900 --> 03:14.040 I have no ability to wrangle large data sets. 03:14.440 --> 03:21.740 So yeah, if you're in the audience and you are professional in any of those areas, I apologize in advance. 03:21.740 --> 03:28.480 I'll probably butcher your fields of expertise and misrepresent entirely. 03:28.480 --> 03:33.980 But yeah, I just, I didn't have any of that stuff and just had a crack at it anyway. 03:37.130 --> 03:39.010 So this is my second DEF CON. 03:39.290 --> 03:42.830 I came here last year as like a bucket list thing with a few friends. 03:43.110 --> 03:45.110 We went and visited the wall of sheep. 03:45.290 --> 03:49.190 If you haven't been there, I recommend doing it at some point in the conference. 03:49.190 --> 03:56.270 And we love the idea of like a practical way of kind of showing people what they were leaking on a network, an unsecure network. 03:56.410 --> 03:59.830 And yeah, we thought that was an awesome idea. 03:59.830 --> 04:07.470 And like most things, after a few refreshing beverages, we kind of thought to ourselves, that's a really awesome idea. 04:07.470 --> 04:13.870 You know, during the conference, showing people over those four days, what kind of stuff they're leaking. 04:13.870 --> 04:23.130 But what about all the stuff that people are leaking 365 days of the year, sharing on social media, everything about themselves. 04:23.790 --> 04:27.950 And yeah, from there, we were like, wouldn't that be a cool way? 04:27.950 --> 04:32.150 Wouldn't that be a cool presentation to sort of collate all that information? 04:32.950 --> 04:36.330 And yeah, present it back in a kind of like wall of sheep online edition. 04:36.330 --> 04:38.450 So that's what we kind of came up. 04:40.130 --> 04:41.650 So this is what we're going to be talking about. 04:41.650 --> 04:44.290 What would a wall of sheep online edition look like? 04:45.150 --> 04:51.110 Starting with my most overconfident plans, you know, someone with no ability to do it, deciding to go and do it. 04:52.210 --> 04:53.830 Yeah, what even is a leak? 04:53.830 --> 04:56.250 Took a little bit of time to kind of like have to work that out. 04:56.250 --> 05:02.610 I had no idea what I was looking for or defining what that was going to be. 05:02.910 --> 05:05.130 I needed to learn the recon game. 05:05.130 --> 05:07.730 I had no kind of clue what was going on there. 05:07.910 --> 05:14.210 And then sort of like the rest of this talk is really just talking about how I started hunting and gathering and finding those people. 05:14.450 --> 05:24.550 And then I promise, if you sit through all that, the last few slides, we'll be talking about sort of the most juicy slide packs of people that I found. 05:27.520 --> 05:30.080 Yeah, so I was like, how hard could it be? 05:30.080 --> 05:32.780 You know, everyone knows people leak stuff online. 05:32.780 --> 05:36.140 Everyone knows people overshare all the time. 05:36.140 --> 05:42.860 Social media these days has us lulled into this idea that, you know, oversharing is what you should be doing on social media. 05:43.140 --> 05:54.260 So I was like, I'll just find some target group, come up with some things to look for and then, you know, manually sift through and just try to find interesting folks. 05:54.540 --> 05:58.540 And then shortlist those people and then monitor those juicier profiles. 05:58.540 --> 06:00.240 And that was kind of it from the beginning. 06:00.240 --> 06:05.320 I was like, you know, had no real grand plans to actually do a talk like this. 06:05.320 --> 06:08.900 It was actually just for shits and gigs in the sidelines. 06:09.100 --> 06:12.120 And then just sit and wait, essentially, see how long it took. 06:13.500 --> 06:23.960 And then at some point, we're like, oh, yeah, wouldn't it be awesome if we actually just went after the DEF CON community instead of just any random community for a few reasons. 06:24.860 --> 06:41.120 So as you're probably aware, if you are all those people who are in the DEF CON subreddit, there's also a whole bunch of other social media platforms that the DEF CON attendees like to use, such as the forum, such as the Discord, and yeah, and the Reddit group. 06:41.220 --> 06:45.880 So all of those things kind of is really helpful because they all have great history. 06:45.880 --> 06:47.480 There's heaps of discussion on there. 06:47.480 --> 06:50.240 There's all different types of people on there, different skill sets. 06:51.280 --> 06:56.500 And one really awesome thing about you hackers is you like to reuse your handle everywhere. 06:56.500 --> 07:00.100 So that was really good to kind of like just track people across those three different areas. 07:00.640 --> 07:02.320 And also it's on topic. 07:03.260 --> 07:08.940 But yeah, for the rest of the brief, though, I actually just focused on the subreddit. 07:10.900 --> 07:12.620 So yeah, where the hell do I start? 07:12.620 --> 07:25.760 I was like, it's one thing to sort of come up with this idea that wouldn't it be funny to scrape a whole bunch of social media, but without any kind of idea of what to do or where to find the information, what am I even looking for? 07:26.020 --> 07:32.080 I was kind of like in a bit of a pickle in terms of actually starting. 07:35.260 --> 07:40.160 So yeah, we're all kind of aware of what PII is, personal identifiable information. 07:40.160 --> 07:49.980 I was pretty full bottle on what that kind of meant, you know, your name, date of birth, social security number you guys have, all that kind of like basic stuff. 07:49.980 --> 07:52.160 I was pretty sure I could find that kind of thing. 07:52.380 --> 07:57.060 But what about all the other stuff that people leak in terms of like their own personal information? 07:58.020 --> 08:09.500 It was kind of a pretty wide scope and I didn't really have much direction as to how to sort of define it or where to find it or any kind of like ability to do that at that stage. 08:10.800 --> 08:26.720 Fortunately, back home at my company, I had a guy who's sitting right next to me who has a PhD in cognitive behaviour and sort of is a proper scientist regarding that. 08:26.720 --> 08:35.360 And he was actually researching at the time the tendencies, the language and the behavioural patterns of people preceding OPSEC incidents. 08:35.540 --> 08:41.560 And so I was like, Riley, tell me how to find this stuff or is there any manuals? 08:41.560 --> 08:43.400 Tell me how to like search for it. 08:44.360 --> 08:59.640 And he pointed me down the track of, you guys have some amazing resources here in America, your three-letter agencies like CIA, FBI, the National Centre for Counterintelligence all have really great manuals and doctrine online. 08:59.640 --> 09:01.560 And I was like, that's a really great place to start. 09:03.220 --> 09:12.380 And not, sorry, not forgetting the social engineering community here was a really awesome treasure trove of sort of ways to find individuals and sort of target individuals. 09:12.380 --> 09:22.060 So I used all that, all those kind of resources to kind of guide me in how I was going to find this other kind of information beyond PII. 09:23.920 --> 09:39.660 And yeah, I came to the, they were all sort of pointing to the idea that there are these sort of like vulnerable, sort of personal vulnerability traits or more easily manipulated life situations or sort of like leverageable information. 09:40.660 --> 09:43.160 Yeah, like, you know, the Russians call it kompromat. 09:43.480 --> 09:45.500 And I was like, ooh, kompromat. 09:45.500 --> 09:53.880 I think I'll add that to my list of things I'm looking for beyond the sort of normal names and addresses and things like that. 09:54.440 --> 10:04.960 And my kind of simple mind could sort of track that as a kind of like easy way for an attacker or a malicious actor to search for, you know, stuff to find like a soft target. 10:04.960 --> 10:07.100 So I was like, that, that makes sense. 10:09.660 --> 10:19.460 Yeah, so I came up with this idea or this term called PVI, personal vulnerability information, you heard it here first, as opposed to traditional PII. 10:20.140 --> 10:36.240 Traditional PII is just those like super basic attributes that we're all kind of aware of and that organizations and governments, government policy like to, or have in their, in their policies to protect. 10:37.120 --> 10:40.980 And your standard security awareness programs also have this stuff in it as well. 10:40.980 --> 10:43.260 It's mostly, you know, don't put this stuff online. 10:43.400 --> 10:59.800 But if you compare that to all the other stuff that are people leaking, and, you know, isn't necessarily protected by this legislation or policy, you kind of have to ask yourself, like, which one do I, which one would I prefer to see in a leak? 10:59.840 --> 11:03.820 And also, which one am I actually leaking myself all the time? 11:07.240 --> 11:17.040 See, I was beginning to see, I was beginning to learn that PII is sort of like just scratching the surface in terms of like online targeting of people. 11:18.780 --> 11:28.640 Yeah, and I was really realizing that like the real bad dudes out there are actually searching for people who maybe will leak rather than people who already have leaked. 11:29.460 --> 11:45.160 And so if you think about all those things on that original slide, I was talking about all those like PII versus PVI, all this stuff that you might be in the blue column over here, have this like, provides an attacker with options to target you. 11:47.720 --> 11:52.100 So I was like, who are these bad dudes who are using this kind of stuff? 11:52.100 --> 11:58.000 And in all of the research that I was doing, I was realizing that, you know, it's not just the usual suspects that we're talking about here. 11:58.000 --> 12:00.940 I'm not just talking about APTs and hacktivists. 12:00.940 --> 12:24.920 We've all heard the stuff about, you know, online radicalization of young jihadis and things like that, which actually also adding, you know, stalkers, jealous ex-partners, child predators, all of these other malicious actors online who are using the exact same methodology of trying to find vulnerable targets using the language that they're presenting online. 12:28.740 --> 12:29.840 Yeah, so I had the what. 12:29.840 --> 12:30.920 I was like, okay, that's great. 12:30.920 --> 12:37.540 I'll be searching for actual facts about people and then kind of like personality types, language use, and those kind of things. 12:37.540 --> 12:45.260 Now, how the hell do I find that stuff on, you know, large, large space of information? 12:46.040 --> 12:50.920 So if you've been working in cyber security for a minute, you'd be aware of the intrusion kill chain. 12:51.120 --> 12:52.640 Just wanted to put that up there. 12:52.900 --> 12:59.220 We are definitely in the reconnaissance phase here, just researching, identifying, and selecting targets. 12:59.540 --> 13:02.220 And I was kind of trying to work out like how I was going to do this. 13:02.220 --> 13:12.060 So I just decided to smoosh all this kind of like, all these different organizations, methodologies into one kind of, into one, like my plan. 13:12.360 --> 13:23.500 So use the CIA's methods of like spot assess and develop, and also mixed in a bit of like the military concept of find, fix, finish. 13:23.500 --> 13:41.000 And using those things, using those resources online, like, particularly want to add the Department of Justice has awesome annals of, you know, cases here in America, like they kind of document exactly how espionage cases unfolded and how those people were approached online. 13:42.060 --> 13:50.640 Yeah, and I came up with the idea of like find, fix, follow, which I realize is just, it's just pretty rudimentary, but sorry, fix, find, follow. 13:50.940 --> 13:55.460 So I fixed, chose the haystack, chose the DEF CON subreddit. 13:56.180 --> 14:07.180 I was going to find those people using those terms amongst the anonymous users, anonymous users, and then assess for leakage, leakability, and tag those people for monitoring. 14:07.720 --> 14:15.640 And really at this stage, I was just doing this pretty rudimentary, just control F, you know, finding, finding words. 14:15.740 --> 14:18.040 So it's pretty basic at this stage. 14:23.630 --> 14:26.730 Yeah, so sort of coming to the part where I started, started doing it. 14:26.730 --> 14:38.090 So I had to have some assumptions to start with, was deciding that like people who reveal in DEF CON, sorry, Reddit slash DEF CON will reveal elsewhere is a pretty basic kind of assumption. 14:39.430 --> 14:43.690 If you're not aware, the DEF CON Reddit is pretty small. 14:43.690 --> 14:48.630 It's pretty small traffic, low traffic, sorry, compared to other subreddits around there. 14:48.630 --> 14:52.030 And it's going to be a pretty small percentage of those users posts. 14:52.550 --> 14:59.490 So I was like, okay, if I find situations in that, I'm just going to track where else they're posting and try and find more information from that point. 15:00.470 --> 15:03.710 Yeah, people who reveal big things probably do small ones also. 15:03.710 --> 15:04.850 That's a no-brainer. 15:05.010 --> 15:06.530 There is going to be old information. 15:06.530 --> 15:16.990 It's very old, you know, it's not very old, but as years go by, there's going to be stuff where people have changed, changed the information that they're presenting. 15:17.710 --> 15:24.810 And of course, there will be deception because, you know, I realise you guys, you hackers are slippery bastards. 15:25.250 --> 15:33.190 So I was really just searching for things like I work for, my email address is, my name is, and I live in. 15:33.190 --> 15:40.790 I realise that's pretty amateur hour, but that's just kind of like the small brain position I was in to start with. 15:43.490 --> 15:46.730 Yeah, scraping was pretty slow, had limited results. 15:46.730 --> 15:51.590 I was really only finding one, two, three things and sort of just slowly plodding away. 15:51.790 --> 15:53.410 And I was limited to those keywords. 15:53.410 --> 16:02.370 Well, I'm not limited to those keywords, but I was limited by those keywords, just searching for those few things that I could think of as what would be good strings to search for. 16:02.390 --> 16:05.230 I wasn't finding the kind of stuff I was after. 16:05.230 --> 16:09.810 And at that stage, I was like, I'm not really hacking this. 16:09.810 --> 16:11.750 I'm really just pushing forward. 16:12.570 --> 16:27.670 But then, you know, GPT entered the chat and I started to ask it to help me define those leaky or vulnerable language and really open up those keywords to much more things than I could consider as possible things I wanted to search for. 16:28.550 --> 16:34.630 And still some manual sifting needed then to, after I found those initial targets through posts. 16:34.730 --> 16:37.670 But those juicy individuals started to grow. 16:37.670 --> 16:45.450 At this stage, I think I had like two or three people with one or two little posts where I was like, okay, I think I'm starting to develop something here. 16:47.690 --> 16:57.890 And yeah, so if you've used chat GPT in the past or currently, you probably know it does require a bit of sort of convincing to get it going. 16:57.890 --> 17:03.810 I had to kind of convince it I was reviewing my own chat logs, make sure I wasn't revealing any personal information. 17:04.330 --> 17:10.290 And I was quite happy to come up with, you know, things that I should be looking for to try and find PII and PVI. 17:10.970 --> 17:12.090 And I was like, awesome. 17:12.870 --> 17:16.570 But can you give me the sort of like words that might precede a leak? 17:16.570 --> 17:21.610 That would be a bit more helpful than just giving me the concept of the kind of things that people are looking for. 17:23.450 --> 17:27.210 Yeah, and I was like, okay, can you give me a hundred different versions of that? 17:27.710 --> 17:33.350 Which was really helpful because then I could sort of just still doing my control F, still looking through. 17:33.550 --> 17:46.310 At some stage, I discovered there's like a year ago, it was still functioning, was a push shift IO, which is like a website we can do live queries of Reddit data. 17:46.570 --> 17:55.190 And I was just really just mandrolically going through and inserting these keywords in there and trying to search and then going back onto the subreddits trying to find the information. 17:55.690 --> 17:57.630 It was still very, very clunky. 17:57.630 --> 18:07.070 As you can imagine, some of these keywords, some of these sort of preceding strings aren't exactly the kind of language that people are using in the DEF CON subreddit. 18:08.030 --> 18:12.090 I received an email from, it's just not the language that's really in there. 18:12.250 --> 18:15.150 But I was finding some stuff here and there. 18:18.100 --> 18:34.000 Yeah, everything was going pretty great until, if you're a user of Reddit or if you're aware, Reddit halfway through last year or halfway through this year just decided to cut all access to third-party apps and my super powerful search tool just kind of went dark. 18:34.640 --> 18:46.060 And I was left sort of... motivation died, regretted not finishing earlier, not producing any slides because I had already actually sent this presentation to DEF CON. 18:46.060 --> 18:48.640 So I was like, had nothing. 18:49.120 --> 18:51.860 And I was kind of like, six weeks of just like, whatever. 18:51.860 --> 18:52.980 It was a smart idea. 18:52.980 --> 18:55.300 Well, I thought it was a smart idea to begin with. 18:55.800 --> 19:00.040 And I was like, it's probably not going to be possible now. 19:01.440 --> 19:12.180 But then, from total failure, I realised that some saint had been archiving Reddit data since the beginning of time. 19:12.180 --> 19:21.500 So there was literally every single post, every single comment that had ever been made in Reddit in one gigantic text file. 19:22.580 --> 19:23.960 And so I was like, sweet. 19:24.040 --> 19:26.880 50,000 comments, 6,000 posts. 19:26.960 --> 19:29.160 Now I wasn't just looking at the last 12 months. 19:29.160 --> 19:31.080 I had 18 years worth. 19:31.540 --> 19:36.720 The Reddit... sorry, the DEF CON Reddit doesn't go back that far. 19:36.720 --> 19:47.240 But now I was really just looking at a decade's worth of comments, which gave me a much more big... sorry, a much larger data set to look through. 19:50.560 --> 19:51.220 Yeah, sorry. 19:51.220 --> 19:55.860 So at that stage, I was... yeah, so I'm... sorry, it's kind of... 19:57.840 --> 20:01.840 one of the problems with doing one of these briefs is you've got to remember what you were doing 12 months ago. 20:03.100 --> 20:04.860 Now I was working with a text file. 20:04.860 --> 20:16.440 So now I'm just really just searching through a text file, you know, using Python to just search for strings within the text file, rather than looking on Reddit online, using the search. 20:18.880 --> 20:24.460 But yeah, at some point during the year, I was listening to a Darknet Diaries episode, big Darknet fan. 20:24.700 --> 20:28.860 And I was listening to Sam Bent, who he presented last year at DEF CON. 20:28.920 --> 20:37.620 He was talking about how he was using... he was trying to circumnavigate the US Postal Service to send drugs through the mail. 20:37.620 --> 20:39.820 And he was trying to work out how he was going to do it. 20:39.820 --> 20:49.040 And he was like, well, one of the, you know, one of the things, best things about the Postal Service is they have a manual online for what good looks like, what they're searching for. 20:49.040 --> 20:51.160 And he was like, I'll just do the opposite. 20:51.460 --> 20:55.220 And I was driving along, I was like, I think I could just do the opposite. 20:56.820 --> 21:10.280 So I went online to the Australian government website to try and find like the kind of attributes that they are looking for when they're trying to give people security clearances, or they're looking to give people security clearances. 21:10.560 --> 21:16.020 And I was looking for attributes for people in that sense, because I was like, well, that's good, that's safe. 21:16.020 --> 21:25.240 Those are the things that they think people will present as, you know, being able to keep a secret or being able to, you know, keep the nation's secrets. 21:25.880 --> 21:30.920 And I was like, hey, ChachiPT, give me all the synonyms for all of those things. 21:31.660 --> 21:34.780 And then also give me all the antonyms for all of those as well. 21:34.780 --> 21:41.160 So I came up with a huge list of antonyms of like the types of people that I was looking for online. 21:42.600 --> 21:46.920 And then I was like, find me all variations of that. 21:46.920 --> 21:57.740 So sort of like just punched out hundreds and hundreds of different sentences, which might suggest the type of person who presents those kind of characteristics. 21:58.980 --> 22:09.180 And yeah, now I really felt like I was cooking with gas, because I was not only searching for these things, I was searching for sort of permutations or variations of those, just little chunks of those. 22:09.180 --> 22:13.580 And I was really finding a lot of results using this method. 22:16.540 --> 22:18.780 Yeah, so I also wanted to find those leak facts. 22:18.780 --> 22:21.560 So thinking back to the beginning, I was also trying to find PII. 22:22.060 --> 22:36.960 So, you know, from a slow and sort of like noisy scrape, I was now using those kind of that, you know, GPT enhanced powerful semantic search to try and find words, which sort of seemed like the person was either going to leak or had leaked. 22:37.300 --> 22:40.420 The search method didn't change for using the PII. 22:42.060 --> 22:45.300 I just had to obviously assess the leak's impact. 22:45.300 --> 22:51.020 So some stuff that people are leaking is really just sort of basic stuff, like down in this green area. 22:52.440 --> 22:59.500 You know, I just put this together to try to like kind of visualise how I was assessing the kind of things that people are leaking. 22:59.500 --> 23:06.400 And it's kind of what I call this death by thousand likes, because lots of the stuff, sure, whatever, it's just online. 23:06.400 --> 23:10.220 But you know, when you add it all up, it really is and has an accumulative effect. 23:12.500 --> 23:16.300 Yeah, so I had to assess the impact, but also like the frequency. 23:16.300 --> 23:24.240 If you're, you know, if you have 500 comments in the sort of green, yellow area, maybe that's sort of only worth like one comment in the red area. 23:24.480 --> 23:27.300 There's still heaps of error, as you're probably aware. 23:27.700 --> 23:32.620 Chachipiti made a lot of things up a lot of the time and it was still very human-driven. 23:32.620 --> 23:34.940 I was still searching through and finding. 23:35.400 --> 23:42.520 I still had to go through and look through the results and actually kind of prove or disprove whether it was actually what I was looking for. 23:45.380 --> 23:48.060 Yeah, as you can probably imagine, 18 years is a long time. 23:48.200 --> 23:54.980 I had lots of false positives, lots of like comments that people were making and I was just like, that's nothing. 23:55.340 --> 23:57.040 So that was taking quite a lot of my time. 23:57.040 --> 24:03.840 It was taking quite a lot of energy and it was pretty boring looking through lots and like hundreds of false positives. 24:03.920 --> 24:05.500 There's lots of non-repeat offenders. 24:05.500 --> 24:14.500 So like you might make one mistake like one time 10 years ago and post something about yourself and I just sort of like wasn't interested in that. 24:15.440 --> 24:17.780 And there was lots of target drop-off as well. 24:17.780 --> 24:22.460 So like lots of the people I was looking at, lots of the results was happening a long time ago. 24:22.460 --> 24:25.600 Those people might have just like moved on and not even been into security anymore. 24:25.600 --> 24:27.340 So I kind of wasn't interested in that. 24:27.940 --> 24:31.440 The one thing I want to say about that is like it's only bad in this context, right? 24:31.440 --> 24:36.500 So I'm trying to find people, I'm trying to produce slides that are interesting for you guys to look at. 24:36.500 --> 24:48.980 If it's a malicious actor, if it's like those stalkers or predators or whatever or more advanced enemies where like you need to imagine like they only need one slip-up or one thing that they're looking for. 24:49.100 --> 24:51.040 So it's only bad in this context. 24:52.540 --> 24:55.080 Yeah, and today we're only going to look at high-quantity packs. 24:55.080 --> 24:58.660 I didn't really put anything together where someone had just made one slip. 25:00.820 --> 25:06.280 But I was also thinking now I'm actually, you know, now I've got big brain, big brain mode. 25:07.080 --> 25:14.740 And then, yeah, sort of like a couple of months ago, as you're probably aware, OpenAI gave us access to the API. 25:15.120 --> 25:16.380 So this was huge. 25:16.380 --> 25:19.660 I was like, whoa, god mode. 25:19.860 --> 25:31.940 I was now able to just plug the data, the massive text file of all of those comments straight into the ChatGPT prompt and just literally ask it questions about the data. 25:35.320 --> 25:43.380 Yeah, so as I said at the start, this is meant to be like a no prior knowledge brief and I certainly had no prior knowledge before I started it. 25:43.380 --> 25:47.720 But what it meant was I didn't have to produce any search scripts anymore. 25:48.220 --> 25:53.460 I was no longer in charge of coming up with creative versions of the kind of stuff I was looking for. 25:53.780 --> 25:55.540 I no longer needed to. 25:56.140 --> 25:57.440 Yeah, sorry I said that. 25:58.080 --> 26:02.620 I just left it all up to the large language model, which was awesome. 26:03.800 --> 26:05.740 It was really limited only by tokens. 26:05.740 --> 26:11.480 If you're not aware, when you're asking it questions, you are limited by a number of characters in and out. 26:11.480 --> 26:13.560 But that really only just slowed me down. 26:13.560 --> 26:18.200 I just had to like chunk up the data into smaller pieces and re-ask the questions over and over. 26:19.380 --> 26:36.460 And in the meantime, since creating this brief and OpenAI forging ahead with its speed of technology now, that characters that you get in and out has multiplied by a factor of I think like six or eight. 26:36.460 --> 26:41.220 It's huge number of... a huge token limit now. 26:42.860 --> 26:46.740 Yeah, so now that's an example up there of the kind of things I was asking. 26:46.740 --> 26:56.540 I was like, okay, so hey, this data set that I have is a huge list of... it's a play of people who are preparing to go to a hacking conference. 26:56.880 --> 27:00.540 Some people in there are really awesome, saying really positive things. 27:00.540 --> 27:07.800 And some people in there are kind of like exhibiting narcissistic or psychopathic kind of like traits. 27:07.920 --> 27:10.040 Give me a list of the top five. 27:10.160 --> 27:11.340 And it was just like an instant. 27:11.340 --> 27:12.160 There you go. 27:12.580 --> 27:17.580 Here's your five top targets, which was sweet. 27:19.560 --> 27:27.180 I was like, okay, so in the data, give me a list of users that are suggesting the propensity to commit crimes. 27:29.770 --> 27:31.310 Show me where they live. 27:31.810 --> 27:38.710 It wasn't actually showing me where they live, but it was sort of saying like show me all the users that talk about a town name, city name, or anything like that. 27:38.710 --> 27:48.630 So if you can imagine comparing to back when I was previously just using Python to search through, I would have had to look through in terms of like a dictionary search of every single town, every single place. 27:49.130 --> 27:54.490 But obviously, yeah, you know, just knows and goes, here are all the people that say where they live. 27:59.020 --> 28:01.080 Show me users that suggest fear. 28:04.490 --> 28:05.430 Yeah, this is an interesting one. 28:05.430 --> 28:12.810 Show me for a specific user over the last 10 years, when they're online, when they make their posts. 28:18.280 --> 28:26.480 And finally, I was like, show me anyone who's looking for anything, who has posted anything about working on anything special or out of the ordinary at their work. 28:31.970 --> 28:41.030 Yeah, so I guess the concept of the speech that I'm trying to get across is that the barriers of entry are completely gone. 28:41.450 --> 28:45.530 All those questions that I was asking in the beginning of how am I going to do it? 28:46.170 --> 28:48.250 You know, what even search terms am I looking for? 28:48.250 --> 28:48.950 What comments? 28:48.950 --> 28:50.990 What about things that don't match the terms? 28:51.210 --> 28:53.310 How do I do it at scale? 28:53.550 --> 28:55.510 Where is it centralised? 28:55.510 --> 28:57.210 And when to do it? 28:57.210 --> 29:06.730 All of that stuff is completely gone because of all of these things that make up what we would consider like the capabilities required to do that. 29:06.970 --> 29:17.930 They're all inherent and anyone here can literally go online and do online targeting of people with absolutely no experience whatsoever. 29:21.770 --> 29:25.410 Yeah, in some of my rehearsals, someone was like, oh, can't you TP4 just do this now? 29:25.410 --> 29:28.530 Like, you use plugins that you can just connect to the internet and you can just do it. 29:28.530 --> 29:33.930 But unfortunately, it's quite resistant to this kind of these kind of questions. 29:34.130 --> 29:37.790 No matter how hard I tried, TP4 is not happy to do it. 29:38.730 --> 29:48.490 So, you know, getting the data, saving the data down, getting it offline, putting it onto your computer, and then using the prompts to scan through it, much more successful. 29:53.860 --> 30:01.680 And now, let's talk about, I think I've got like five or six target packs here that I'm going to talk through. 30:02.060 --> 30:07.200 Before I start, I just want to have to make a few caveats to the things that we're going to look at. 30:07.460 --> 30:17.140 Certainly, this is not a representation of DEF CON attendees at all, like just like, you know, any subreddit, anyone in the world can join up. 30:17.440 --> 30:19.440 I think it has like 30,000 members. 30:19.760 --> 30:24.320 So it's definitely not a representation of you guys here today. 30:26.160 --> 30:30.040 What were the other... one second, sorry. 30:32.600 --> 30:35.340 Had some very important caveats I wanted to make. 30:36.180 --> 30:36.840 Oh yeah, sorry. 30:36.840 --> 30:45.860 So the people who are up here obviously have their own, make their own decisions, they have their own threat model, their own thresholds of like what they want to reveal online. 30:46.140 --> 30:50.420 They probably have their own understanding of like how much they have revealed. 30:51.480 --> 30:53.940 Oh yeah, and one other thing is on the fly out over here. 30:53.940 --> 30:57.760 I had a lot more information on these slides about what people had posted. 30:57.840 --> 31:07.380 But I had kind of like a moment of clarity where I was like, well, you know, if I put up any one thing that they've revealed, that kind of reveals everything. 31:07.380 --> 31:10.160 So I did a lot, a lot of blurring on the way over here. 31:10.160 --> 31:17.180 So I apologize if it's a little too blurry for the kind of blood that you wanted to see. 31:17.440 --> 31:22.820 But you know, people's privacy also in an area like this is important. 31:23.000 --> 31:24.760 Anyway, let's get on with it. 31:25.540 --> 31:34.820 So the first guy or girl, the AI hit four email addresses containing first name, last name. 31:35.360 --> 31:38.060 I wanted to see talk about any illegal activity. 31:38.060 --> 31:47.240 I asked it to find comments about suffering and also any kind of, you know, device information or models of modems and things like that. 31:47.240 --> 31:50.480 So the first person, you know, quite a lot of hits here. 31:51.340 --> 31:54.280 Router brand model, drug use. 31:54.700 --> 31:57.980 You know, I'm not here to pass judgment on anyone using drugs or whatever. 31:57.980 --> 32:16.700 But you know, if you are going to post that in an online forum, you know, with all kinds of actors looking at you, judging whether you're a target, and you're going to kind of reveal that there are moments of vulnerability about your life, that could be a valuable data point. 32:17.280 --> 32:21.800 This person's right into conspiracies, you know, very easily manipulated, I would imagine. 32:22.840 --> 32:24.320 Crypto bro, yep. 32:24.800 --> 32:38.320 And the other thing was, yeah, so like, one thing if you think about like, malicious actors trying to contact people or trying to like, have a pathway to conversation, they might have to choose between a bunch of like, their hobbies or interests. 32:38.840 --> 32:43.260 You know, a shortcut or a cheat code to that is like, if they're actually seeking a mentor. 32:43.260 --> 32:49.200 So this person, you know, not too much here, but quite a lot of attack pathways. 32:53.090 --> 32:59.710 Yeah, so this one, I actually pulled a lot down because this person was actually posting a fair bit about themselves. 32:59.710 --> 33:03.550 But this one's going along the lines of like, that's the stalker kind of threat. 33:03.910 --> 33:20.870 So the individuals posted, you know, their home location, where they live, but also, you know, their name, age, backstory, quite a painful past, lots of like, experiences of racism, things like that, that an attacker could look kind of used to build rapport. 33:20.950 --> 33:25.210 But the other thing they mentioned was they're traveling alone to DEF CON. 33:25.490 --> 33:45.870 And was, we're going to be at location ABC, you know, and if you're, you know, a female traveling alone, and you're going to reveal everything about yourself and your backstory, as well as, you know, positive ID of what you look like, it's quite a lot of stuff for us quite a lot of sort of opportunities for someone who's trying to, 33:45.870 --> 33:49.450 you know, go after you to to have, you know, in their back pocket. 33:53.050 --> 33:54.510 Yeah, this one's interesting one. 33:54.510 --> 34:00.310 So this one, ChachiPT hit for weekend activities, small towns and use their first name. 34:00.310 --> 34:01.650 So it wasn't a lot of things. 34:01.650 --> 34:11.130 But you know, after I kind of was like triaging through, this is kind of like a very efficient and minimalist kind of pathway to an attack. 34:11.130 --> 34:17.670 So if you're going to talk about the city or state that you live in, particularly this one, I think that the population was like under 100,000. 34:18.010 --> 34:22.630 But also talk about a place of interest that you and your family visit on a frequent basis. 34:22.770 --> 34:29.390 And finally, talk about your vehicle description, right down to, you know, decals and stickers on the back of it. 34:29.390 --> 34:35.310 If someone, you know, had that kind of information, they wanted to sort of get close to you or get close to your house. 34:35.910 --> 34:41.750 It's all they would really need to target you from an individual perspective. 34:42.410 --> 34:42.870 Yep. 34:42.870 --> 34:43.890 Breed of pet. 34:45.010 --> 34:45.790 Sure. 34:45.790 --> 34:48.370 Some of the slides have that kind of stuff in there. 34:48.370 --> 34:54.770 Not just talking about, you know, those standard don't do security things like tell people your secret questions. 34:54.930 --> 35:01.090 But if you're going to talk about your breed of pet, I think this is like the French Bulldogs. 35:01.090 --> 35:07.130 Something to do with like every pet I've seen in DEF CON is French Bulldogs. 35:07.590 --> 35:12.990 But if you're going to talk about that, you know, you're opening yourself up to pretty effective spear phishing and things like that. 35:13.030 --> 35:15.610 Person's also very open to online comms. 35:19.780 --> 35:23.040 Yeah, so this guy hit for got a security clearance. 35:23.040 --> 35:25.180 I live in X location and ranks. 35:25.180 --> 35:33.140 So this is a military person, you know, posted to a certain location, revealing their career goals. 35:33.140 --> 35:42.160 You know, if the attacker is thinking about, you know, everyone has something that they want or that they're going after, if you're going to reveal your goals, that's kind of like an easy kind of offering for you. 35:42.820 --> 35:54.320 Talk about their career timeline, grievances at work, military rank, and their workplace and their openness and their kind of like approach to authority. 35:54.420 --> 35:56.820 So quite a lot of stuff here. 35:57.100 --> 36:04.220 I realised in America, you guys have a little bit of different approach to how you conceal security clearances and things like that. 36:04.640 --> 36:09.860 In Australia, it's fairly, it's just very different. 36:09.860 --> 36:13.760 It's a different approach to how you manage your security clearance. 36:18.860 --> 36:21.180 Yeah, so this one had quite a fair bit. 36:21.180 --> 36:30.140 So I was looking for, I found things for gain seniority, specific device specifications, and things that they were struggling with. 36:30.140 --> 36:42.220 So, you know, the AI found a quite a lot of things across the post from this person, particularly the pet name, breed, became a senior manager quite quickly. 36:42.500 --> 36:56.040 If anyone here is, you know, just to expand on that a little bit, I imagine that probably people here who work for companies that have, you know, significant IP that they want to protect, or maybe you want to work one day for companies that have IP they want to protect, 36:56.040 --> 37:05.820 you know, moving up in management in those companies is probably something that an attacker would be looking for if they're trying to assess your ability, what kind of stuff you know about that company. 37:07.360 --> 37:09.100 Yeah, revealing router brand model. 37:09.100 --> 37:10.840 I'm not 100% sure how bad that is. 37:10.840 --> 37:12.200 You guys would probably tell me. 37:13.040 --> 37:16.380 Personal demons, where they live, and also painful past. 37:16.380 --> 37:23.520 The person experienced quite a lot of bullying, and particularly the number of posts with regards to this was pretty high. 37:23.520 --> 37:34.680 So, you know, in terms of like building rapport and kind of like getting alongside this person, I would imagine that, you know, an advanced attacker would probably have a pretty good chance from that angle. 37:36.420 --> 37:39.580 And last but not least, yeah, this is probably one of my favourites. 37:40.020 --> 37:45.800 This guy posted one time in the entire 18 years of the subreddit. 37:46.140 --> 37:51.260 Posted one time, first name, last name at whatever.com. 37:51.800 --> 37:53.560 And I just googled that. 37:53.780 --> 37:58.020 And straight up, pitches himself at work, ID card. 37:58.460 --> 38:05.000 You know, I'm not assuming that this is any kind of like high security area, and that this is a massive security breach. 38:05.000 --> 38:15.800 But you know, if you only just go over to the to the physical village, you can probably you can get some information about like, just having the picture of the ID card usually will get you like you can create an imitation ID card. 38:15.800 --> 38:23.340 That's like a pretty good bit of information to have if you're trying to get into a facility. 38:23.620 --> 38:26.740 So yeah, don't post pictures of your ID card. 38:31.240 --> 38:43.380 Yeah, so those individual target packs only revealed small things individually, what five or six different things. 38:43.880 --> 38:51.200 But I kind of encourage you to kind of think about your own social media, not just your Reddit posts, but every other social media that you use. 38:51.440 --> 39:08.720 And think about whether, you know, you had more than or accumulated measures, accumulated version of those target packs, and how much information a person would have if they were to just use something like AI, spend a bit of time and create, you know, 39:08.720 --> 39:14.120 create a target pack surrounding you or, you know, individuals that you love or colleagues. 39:15.980 --> 39:18.720 This isn't a real person, that's an AI guy. 39:19.520 --> 39:22.280 But yeah, that's the end of the speech. 39:22.280 --> 39:23.760 Does anyone have any questions? 39:35.930 --> 39:41.310 So did you validate the data that you get it from chatJPT? 39:41.310 --> 39:42.730 So is it real? 39:42.730 --> 39:47.530 Is the data in the data set or chatJPT just imagined it? 39:49.650 --> 39:51.470 Sorry, I think I understood your question. 39:51.470 --> 40:07.010 You're saying, did I validate whether it was accurate, what it was finding versus... yeah, so as you sort of saw in some of those slides, had like what the output of the search was in like the black terminal kind of section. 40:07.010 --> 40:14.050 But then I went back on to Reddit to kind of grade screenshots, make it a bit more user-friendly in terms of a speech. 40:14.050 --> 40:23.430 I did go back, had a look at what the comment was in context, and that kind of, but you know, it just added to the amount of time that I had to spend doing it. 40:23.430 --> 40:26.970 But yeah, that required human interaction. 40:27.570 --> 40:32.850 It was not really possible to just have it completely automated. 40:33.650 --> 40:35.450 Does that answer your question? 40:39.680 --> 40:40.820 Any others? 40:49.310 --> 40:49.910 Okay, yeah. 40:49.910 --> 40:54.390 So the question was, what was the most common leak that you saw over and over again? 40:57.260 --> 41:07.380 Yeah, so these are like, I chose these because they're like the best ones up there for kind of like a broad spectrum of things that people were leaking. 41:09.940 --> 41:12.700 Didn't see a lot of like personal names. 41:12.820 --> 41:17.100 Like I was saying at the start, the DEF CON subreddit was actually pretty hard to do. 41:17.140 --> 41:22.600 Like some of the other ones that I was looking at, like r slash cringe and r slash NFL. 41:23.080 --> 41:29.060 Like I was just sort of like wanting to see how bad this subreddit was versus others, and it was really good. 41:29.060 --> 41:33.420 So it was very difficult to find much information in there. 41:33.420 --> 41:44.900 I know it looks like those few slides, there was lots, but I probably had something in the realm of like maybe 20 or 30, which I thought would be a good starting point. 41:44.900 --> 41:51.720 And probably, yeah, wasn't a lot of like first names, a lot of last names, almost zero like addresses, actual addresses. 41:53.300 --> 41:57.660 There was just lots, and I think that the PII thing was probably fairly covered by people. 41:57.660 --> 42:02.720 I think most people understand and not put those kind of like actual facts about yourself in there. 42:02.820 --> 42:12.160 But the thing I did see posting over and over again was like, yeah, personal, like sort of like own feelings, own mental state. 42:12.160 --> 42:25.600 Last thing I wanted to mention actually, like the mental health slide, the mental health, I think it was like one of the first or second slides had someone was discussing their like mental status. 42:25.600 --> 42:29.500 It was kind of like a really , that was a difficult one for me. 42:29.500 --> 42:39.100 I was a bit conflicted about whether to put that up there because a lot of people use talking about that kind of stuff in a forum to kind of like help them get through it. 42:40.020 --> 42:59.480 But you know, particularly if you're thinking, if you believe you have a high threat model, you know, revealing that kind of stuff to the entire world that you are potentially compromised in different areas, you know, it does open you up to being manipulated in that way or being attacked in that way. 43:00.100 --> 43:04.260 But yeah, I can't think off the top of my head, apologize , what like the most frequent one was. 43:04.260 --> 43:10.980 Maybe that's a good thing to do next, kind of like work out where the where the worst, where the worst leaks are happening. 43:10.980 --> 43:11.920 Thanks, sir. 43:15.110 --> 43:17.690 I had a question about like fact checking. 43:17.750 --> 43:21.590 So especially on Reddit, sometimes people like to role play as different things in different subreddits. 43:21.590 --> 43:28.250 And you'll see people on one forum saying, Oh, I'm a software engineer, in a different thread, they'll say, Oh, I'm an auto mechanic. 43:28.250 --> 43:31.870 And they might not be either, but they want to participate in these threads. 43:31.910 --> 43:38.890 Is there a way that you've kind of vetted information sharing as face fake or true information? 43:39.790 --> 43:40.950 Yeah, that's a good question. 43:41.270 --> 43:54.530 So sort of manually, like manually, what people will do if they're like, if they're calling bullshit on a person, they'll just sort of go to the user and look at all the other, look at all the other posts that are in and go through. 43:56.210 --> 43:59.190 Do it using this to do it, I imagine it'd be pretty easy. 43:59.190 --> 44:02.910 Like, you know, I was only distilled down to that DEF CON subreddit. 44:02.910 --> 44:09.450 So the sorry, the prompt was only focused directly on that text file. 44:10.850 --> 44:22.530 But if you were to compile a bunch of, you know, when you download that torrent, it was just like, which, which, you know, it's like one and a half terabyte, I wasn't gonna download it all, just downloaded the ones that I wanted to . 44:22.550 --> 44:25.790 But if you, I'd imagine this would be how I would go about it. 44:26.050 --> 44:28.110 Again, not a big, not a data guy. 44:28.110 --> 44:29.270 But this is how I would do it. 44:29.350 --> 44:31.750 Go to the person, find all the ones that they're in. 44:32.250 --> 44:41.050 And, yeah, go get that text file, put it all together, and then ask it questions about things like job, things like experience. 44:41.230 --> 44:48.590 And, you know, from the results I got, it is fairly capable in doing that and looking through and finding examples of that kind of stuff. 44:48.690 --> 44:51.090 But yeah, not I didn't, I didn't actually do it. 44:51.090 --> 44:51.650 But thanks. 44:51.650 --> 44:52.170 Yeah. 44:52.990 --> 45:03.950 I was wondering, when you found yourself moving from Reddit to other platforms, could you rank the platforms, which ones people share the most information about themselves on? 45:04.610 --> 45:05.190 Okay, yeah. 45:05.190 --> 45:11.950 So I didn't search through Discord or the forums, just because Discord hates being scraped. 45:11.950 --> 45:17.910 And the forums, I didn't actually find that much, you know, actual information in there. 45:19.070 --> 45:20.190 So yeah. 45:20.670 --> 45:21.570 No. 45:21.570 --> 45:21.910 Yeah. 45:21.910 --> 45:22.750 Thanks. 45:25.010 --> 45:25.890 All right. 45:25.890 --> 45:29.890 I've been given a couple of minutes warning wrap up if there's any one or two questions left. 45:29.910 --> 45:31.630 Otherwise, thanks very much. 45:31.630 --> 45:32.810 Been an awesome audience.