WEBVTT 00:00.000 --> 00:04.920 Good morning, everyone, and welcome to the Village Talks. 00:08.070 --> 00:15.610 It is now my pleasure to introduce to you the very first talks sponsored by the Packet Hacking Village. 00:17.530 --> 00:23.770 It is my honor, but I'd rather not actually speak about this gentleman. 00:24.050 --> 00:27.030 But it is absolutely... all I need to say is this. 00:27.030 --> 00:31.890 It is absolutely my pleasure to introduce to you D-9. 00:31.890 --> 00:32.970 That's his handle. 00:32.970 --> 00:38.950 D-9, who will be speaking on Pwning the Pwners with Mindware. 00:38.950 --> 00:41.210 D-9, it's all you. 00:41.530 --> 00:43.030 All right. 00:44.330 --> 00:49.590 Thanks for, you know, getting up early and showing up for the first talk. 00:50.010 --> 00:54.690 I'm going to probably start a little late. 00:57.350 --> 01:01.130 But this subject, anybody have any background on it? 01:02.190 --> 01:03.690 I mean, so... 01:04.430 --> 01:09.330 Well, I'm hoping that you're here because you kind of looked at the abstract. 01:11.910 --> 01:14.490 But this subject is kind of interesting. 01:14.710 --> 01:16.150 And I'll get into it a little bit more. 01:16.150 --> 01:20.190 But the concept of Mindware is really an interesting thought. 01:20.190 --> 01:24.150 And the theory came out of someone that has no computer background at all. 01:24.150 --> 01:26.630 He's actually a psychologist. 01:27.510 --> 01:30.990 And what he's talking about is programming of the brain. 01:31.670 --> 01:36.230 Particularly how that programming affects your ability to make decisions. 01:37.870 --> 01:41.730 I'm going to talk a little bit about leveraging that theory. 01:41.890 --> 01:47.070 And how we can use it to help the defender side of the house. 01:47.530 --> 01:49.710 Any defenders in the crowd? 01:50.290 --> 01:51.170 All right! 01:51.170 --> 01:52.350 Defenders! 01:54.690 --> 01:58.470 Any attackers or... yeah, okay. 01:59.090 --> 02:01.550 So this talk is about you, man. 02:01.830 --> 02:05.030 And how the defenders are going to own you. 02:05.350 --> 02:06.610 Or pwn you. 02:06.610 --> 02:08.770 We'll see if that actually happens. 02:08.830 --> 02:12.510 I would like some discussion at the very end of this talk. 02:12.510 --> 02:15.370 So I'm going to leave some time at the end. 02:15.370 --> 02:17.330 Because I'm looking for some feedback. 02:17.370 --> 02:19.070 This is early R&D. 02:19.070 --> 02:21.670 I'm talking about early R&D research. 02:21.670 --> 02:24.470 That has not really been done yet. 02:24.470 --> 02:25.940 But conceptualized. 02:26.770 --> 02:31.230 It's going to take over four years to actually do the groundwork. 02:31.470 --> 02:33.630 With the human subjects. 02:33.810 --> 02:38.090 And the computer modeling to actually build the tool that I'm about to talk to you about. 02:39.590 --> 02:42.990 So that's kind of an introduction and background. 02:42.990 --> 02:48.590 Any questions or comments before I jump off into the presentation? 02:48.590 --> 02:56.630 And for those of you out there, this is not a hacking technical talk. 02:56.730 --> 03:02.350 It's actually more of a theoretical talk about how human beings act. 03:02.350 --> 03:04.930 And how we can leverage those kinds of things. 03:05.190 --> 03:09.210 So I would say this is a pretty atypical talk for DEF CON. 03:09.210 --> 03:15.010 And hats off to the Packet Hacking Village for being brave enough to put me on the stage. 03:15.010 --> 03:17.390 To talk about something that's not really technical. 03:17.390 --> 03:19.210 Alright, so I'm going to get going. 03:24.550 --> 03:26.010 So who am I? 03:27.010 --> 03:29.310 Well, for one, I am a bureaucrat. 03:30.770 --> 03:32.470 I am not a hacker. 03:33.930 --> 03:36.330 I spent 41 years in the government. 03:38.310 --> 03:39.930 Three operational deployments. 03:39.930 --> 03:43.630 One to Pakistan and Afghanistan at the end of my career. 03:43.630 --> 03:45.750 Because I'm like, I'm not retiring as a bureaucrat. 03:45.750 --> 03:47.490 I need to go out as a warfighter. 03:47.490 --> 03:50.850 So, retired colonel. 03:51.010 --> 03:53.990 Member of the Senior Executive Service, if anybody knows what that is. 03:53.990 --> 03:56.690 That's a general officer, flag officer, level rank. 03:56.690 --> 03:57.930 I was civilian in the Pentagon. 03:57.930 --> 04:00.750 This gentleman up here is a Fed too. 04:00.750 --> 04:02.510 So I might as well point him out. 04:02.510 --> 04:04.730 So if you're playing that game, there he is. 04:06.510 --> 04:10.070 I directed training and education for the Department of Defense. 04:10.610 --> 04:14.990 I led their Force of the Future working group. 04:14.990 --> 04:21.490 I led their cyber workforce development and recruitment workforce as well. 04:21.490 --> 04:24.710 I have a doctorate from the University of Pennsylvania. 04:24.870 --> 04:27.490 Focus was on hackers. 04:27.650 --> 04:35.370 And it really was about the sociology and psychological aspects of what makes a hacker extraordinary. 04:35.410 --> 04:37.950 We can talk a little bit about that on the way too. 04:38.190 --> 04:42.310 And now, I'm an independent AI and cyber researcher for a small R&D company. 04:42.310 --> 04:43.910 We're a 501C3. 04:43.910 --> 04:48.550 I'm not going to mention the name of the company, but that's what I do now for a living. 04:51.500 --> 04:59.840 So, why do I think that this approach, and we'll talk about what this approach is, is viable? 05:01.300 --> 05:04.220 The interesting thing is the defensive community. 05:04.300 --> 05:08.700 How much emphasis do you guys place on really understanding the attacker? 05:11.060 --> 05:12.960 Yeah, right? 05:12.960 --> 05:19.520 So, a lot of the solutions on the defensive side are focused on the technology aspects. 05:20.100 --> 05:22.880 But the weakest link in an attack is what? 05:23.760 --> 05:25.020 Their techniques? 05:25.020 --> 05:26.140 No, it's the person. 05:26.140 --> 05:27.460 It's the individual. 05:27.660 --> 05:29.000 It's the human. 05:29.300 --> 05:34.220 So, this initiative is really about how do I go after the human? 05:34.220 --> 05:36.160 To hell with the technical stuff. 05:36.160 --> 05:39.140 Let's mess with the human attacker. 05:40.660 --> 05:43.560 How many people have heard of the term cyberpsychology? 05:45.560 --> 05:46.360 One. 05:46.360 --> 05:47.160 Anybody else? 05:48.500 --> 05:49.380 Okay. 05:50.060 --> 05:50.940 It's a new... 05:50.940 --> 05:52.300 When I heard it... 05:52.300 --> 05:54.620 I mean, I heard it within the last year. 05:55.740 --> 05:57.740 My dissertation was in 2018. 05:57.740 --> 06:00.480 I did cyberpsychology work and I didn't know it. 06:01.820 --> 06:03.480 But it's a new term. 06:03.840 --> 06:05.640 And you can see what it's about. 06:06.660 --> 06:09.660 And I'll define it later in the presentation. 06:09.940 --> 06:10.540 So, this... 06:10.540 --> 06:13.800 Again, like I said, this presentation is academically grounded. 06:14.620 --> 06:18.120 It lays out a conceptual R&D design. 06:19.440 --> 06:27.820 And it leverages cyberpsychology, AI, and game theory to build a defensive tool to attack the attacker. 06:30.340 --> 06:32.960 So, there's some foundational research. 06:35.260 --> 06:37.420 One of them is called the Tularosa Study. 06:37.420 --> 06:39.120 Anybody familiar with this study? 06:39.480 --> 06:40.600 Oh, look at that! 06:41.400 --> 06:42.940 What do you think about it? 06:45.520 --> 06:46.420 What was that? 06:47.440 --> 06:48.840 Yeah, I can't hear you. 06:48.840 --> 06:51.180 So, it's too loud in here. 06:51.400 --> 06:55.240 The Tularosa Study was done by the Department of Defense and the Department of Energy. 06:55.240 --> 07:05.060 It's the first study that looked at a very large group, a proficient red team, and tried to mess with their heads. 07:05.060 --> 07:07.220 There was 130 participants. 07:09.000 --> 07:11.080 It was mostly manual. 07:11.160 --> 07:16.820 So, they would put them into part tasks, kind of hacking kinds of tasks, and ask them to work through it. 07:16.820 --> 07:22.720 And then they would plant deception, or not deception, and tell them that maybe there was deception. 07:22.720 --> 07:30.920 So, it caused a lot of confusion and frustration and friction on the part of the attackers, because sometimes they're like, is it real or not real? 07:30.980 --> 07:33.000 Am I being messed with or not messed with? 07:33.000 --> 07:40.060 And it really slowed them down when it came to their ability to achieve the objectives they were asked to achieve. 07:41.040 --> 07:42.540 So, that's one study. 07:43.140 --> 07:51.720 The second one is, and there's at least two, but this is one that I highlight, is this decision-making biases in cyber attackers. 07:51.720 --> 07:55.980 So, are there very specific sets of biases? 07:55.980 --> 07:58.260 And we'll talk a little bit about what those are. 07:58.500 --> 08:01.640 The Department of Defense conducted this research. 08:02.580 --> 08:07.440 It studied an initial list of biases that affect attackers. 08:08.440 --> 08:15.880 The outcome was a list of these kinds of biases, and we'll talk about those also. 08:15.880 --> 08:20.140 There's another study that developed a list of over 80 of such biases. 08:20.140 --> 08:26.880 And these are important because these are the things we're going to go after when an attacker shows up in our network. 08:26.880 --> 08:29.000 We're going to leverage these biases. 08:31.040 --> 08:34.960 So, can we turn the prey into the predator? 08:36.800 --> 08:39.080 Defensive people, are you happy about that? 08:39.080 --> 08:41.040 Do you want to be a wolf or a lamb? 08:42.700 --> 08:49.680 So, this study really is about saying, guys, stop crouching in the corner, waiting for somebody to do something to you. 08:49.920 --> 08:52.020 Take an offensive stance. 08:52.820 --> 08:55.260 Go after the attacker. 08:55.560 --> 08:57.480 Don't wait for them to act. 08:57.480 --> 08:59.160 Control the situation. 08:59.420 --> 09:02.940 Make them feel they're in control, but you're really doing it. 09:05.160 --> 09:11.200 You can see here that the other thing that's kind of interesting is defenders have home field advantage. 09:11.440 --> 09:13.120 You know your network. 09:14.520 --> 09:17.320 The attacker may or may not. 09:18.020 --> 09:22.880 Yet, we don't recognize that as an advantage from a defensive perspective. 09:22.880 --> 09:29.260 And because you know your network, there's things you can do inside of it to affect the ability of that hacker to be successful. 09:30.280 --> 09:36.580 And then, can we automate this approach and use game theory to double down on what we're doing to the attacker? 09:37.300 --> 09:39.720 I'm going to use a very familiar framework. 09:39.720 --> 09:40.760 Five phases of a hack. 09:40.760 --> 09:41.640 I'm not going to go into them. 09:41.640 --> 09:44.980 I think almost everyone in this room understands what those are. 09:45.920 --> 09:47.620 Any questions so far? 09:48.960 --> 09:49.840 Alright. 09:50.800 --> 09:52.860 So, the building box concept. 09:53.380 --> 09:55.820 There's the definition of cyber psychology. 09:56.740 --> 09:57.940 It's a brand new field. 09:57.940 --> 10:00.220 I would say it's probably a couple years old. 10:00.220 --> 10:01.840 Maybe two or three. 10:03.860 --> 10:08.920 But it's really about understanding the human behavior of attackers. 10:09.000 --> 10:15.560 And how that human behavior can be used to manipulate the attacker or the defender for that matter. 10:16.160 --> 10:19.040 I mean, one could call it social engineering. 10:19.300 --> 10:23.860 I'm not sure it's... I wouldn't exactly categorize it as social engineering. 10:23.860 --> 10:25.660 I think it's more nuanced than that. 10:28.220 --> 10:29.880 Some of the components. 10:29.920 --> 10:31.820 This cognitive human bias. 10:32.540 --> 10:38.620 This is a subconscious process by which one makes a decision. 10:39.960 --> 10:44.120 Many times, and we'll talk about it many times, you don't know why you made that decision. 10:44.120 --> 10:45.240 You just make it. 10:48.720 --> 10:50.840 That reveals a vulnerability. 10:50.840 --> 11:03.880 Because those types of decisions, those kind of automatic lizard brain kinds of decisions, emotional based decisions, are vulnerabilities. 11:05.300 --> 11:09.780 The other thing we need to talk about is this concept of bias sensors and triggers. 11:11.780 --> 11:16.860 The bias sensor is used to detect the cognitive vulnerability in the attacker. 11:16.860 --> 11:20.160 And we'll talk about what those are, and I'll take some suggestions from people here. 11:20.160 --> 11:31.000 And then the triggers are the things that, once I know what that vulnerability is, how do I manipulate my network or my host operating environment to take advantage of those vulnerabilities? 11:31.280 --> 11:37.280 And suck the attacker into the things that I want them to look at, as opposed to things that they want to look at. 11:40.360 --> 11:42.860 So, I'm going to hit a little theory. 11:42.860 --> 11:44.880 I hope I don't put any of you guys to sleep. 11:44.880 --> 11:45.740 And gals. 11:47.080 --> 11:49.680 But this is a really interesting theory. 11:49.680 --> 11:54.840 And it breaks the way we make decisions up into three separate minds. 11:56.420 --> 12:01.460 The first one is the autonomous mind. 12:02.280 --> 12:04.080 That's on autopilot. 12:04.620 --> 12:09.780 You don't really think much about the decisions you make using that part of your brain. 12:10.320 --> 12:11.980 Because it's rote. 12:12.740 --> 12:15.460 I mean, this is a really interesting term here, right? 12:16.100 --> 12:18.380 It comes from over-learning and practice. 12:18.380 --> 12:26.000 So when you go drive a car, do you think about actually moving the steering wheel and putting your foot on the brake or the gas? 12:26.000 --> 12:26.720 No. 12:26.800 --> 12:27.880 It's learned behavior. 12:27.880 --> 12:29.140 You do it automatically. 12:29.140 --> 12:30.820 And that's a physical example. 12:31.540 --> 12:34.680 But essentially what we're saying is the brain does the same thing. 12:34.700 --> 12:38.340 There's a lot of things and decisions it makes on autopilot. 12:38.720 --> 12:40.120 That's a vulnerability. 12:43.560 --> 12:49.940 This level right here is really about the critical and intelligence part of the way we make decisions. 12:51.000 --> 12:56.200 So the rhythmic mind is what you measure when you measure IQ. 12:56.900 --> 13:00.460 It's your ability to do analytical and logical reasoning. 13:01.760 --> 13:05.980 But interestingly enough, on top of that is something called the reflective mind. 13:06.400 --> 13:08.280 This mind is about your beliefs. 13:10.060 --> 13:12.620 It's about your opinions. 13:12.700 --> 13:17.580 It's about what you've learned through culture or something called habitus. 13:17.700 --> 13:28.280 So it's learned behavior and it's reflective in nature, meaning that you think and understand why you have the beliefs that you have. 13:30.120 --> 13:34.500 That is what is measured when you take a critical thinking test. 13:34.500 --> 13:42.620 So it's not the intelligence part, it's your ability to reason using that part of your brain. 13:43.960 --> 13:48.920 Those three things are important because of the way in which they affect us making decisions. 13:50.060 --> 13:55.220 Now, when you go look at this chart, this is interesting, right? 13:55.220 --> 14:01.640 So here, sometimes when you're faced with a situation and you need to make a decision, you just make a response. 14:01.640 --> 14:05.660 And you use that automatic part of your brain. 14:05.940 --> 14:10.220 However, the algorithmic mind has the ability to override. 14:11.420 --> 14:20.880 So how many times have you experienced an emotional event and instead of doing the emotional outburst, you decided not to do that? 14:21.720 --> 14:25.820 That is the algorithmic mind overriding your emotions. 14:27.940 --> 14:30.720 That's an important capability, right? 14:30.720 --> 14:35.160 So sometimes we just let our emotions take over and we make this response. 14:35.160 --> 14:42.940 But sometimes we go, hey, wait a minute, maybe I should stop and think about what I'm about to say or do before I do it. 14:43.520 --> 14:45.420 That's this override function. 14:46.420 --> 14:54.020 The reflective mind also has an override capability because the problem with the algorithmic mind is that sometimes it's lazy. 14:55.420 --> 14:59.720 So it'll do a little bit of logical reasoning and then go, okay, I got it. 15:00.900 --> 15:02.740 How many times have we done that? 15:03.220 --> 15:05.580 We'll talk about cognitive misers. 15:05.880 --> 15:17.700 So the reflective mind then allows your beliefs and some of your opinions to get inserted into the creation of alternate approaches to the way you make a decision. 15:17.940 --> 15:19.680 And boom, out it goes. 15:19.680 --> 15:20.960 You have a response. 15:22.200 --> 15:38.860 So that is really important because I'm going to leverage some of those vulnerabilities, particularly the ones that occur down here or that occur in this area or where we can contaminate your mindware up here in your opinions and beliefs. 15:41.300 --> 15:43.980 So let's talk about cognitive miser. 15:44.540 --> 15:49.720 How many of you people really enjoy doing really hard thinking? 15:50.880 --> 15:52.140 Anybody? 15:52.660 --> 15:53.620 Yeah. 15:53.820 --> 15:58.260 And by the way, that is a trait of a lot of people in this business. 15:58.560 --> 16:01.480 That kind of thinking is something they enjoy doing. 16:02.360 --> 16:07.360 But even in that process, do you want to work harder than you need to? 16:07.780 --> 16:09.200 That's the question. 16:09.600 --> 16:18.500 So this cognitive miser concept is really about, like, do I really want to work that hard with the gain that I'm looking to get? 16:18.500 --> 16:22.720 So your brain goes, here, let me take some shortcuts. 16:22.760 --> 16:26.320 Not full automatic shortcuts, but shortcuts. 16:27.240 --> 16:36.680 So sometimes the miser will fail to override the autonomous mind and you'll just make a decision. 16:38.320 --> 16:56.620 Sometimes it'll go into a more reflective mode or a more logical mode, but still having some kind of focus that maybe overrides other data points in the environment and you make another decision that, again, is maybe sub-optimized, but allows you to not have to put too much effort forth. 16:56.640 --> 17:01.260 And then finally, we talked about this default to the autonomous mind where it just takes over. 17:03.000 --> 17:08.300 Now this one, this one is really interesting because this is about the higher levels of thinking that I talked about. 17:08.300 --> 17:12.360 The algorithmic brain and the reflective mind. 17:12.880 --> 17:14.960 This is a big problem. 17:16.460 --> 17:18.100 Mindware contamination. 17:20.260 --> 17:29.780 The things that are happening in social media could be categorized by some as mindware contamination. 17:29.780 --> 17:34.000 They're going after your beliefs and understandings of things. 17:34.320 --> 17:41.100 And they're contaminating your ability for your reflective mind to really use good data to make decisions. 17:42.920 --> 17:50.580 That's also a vulnerability and if you look at what's going on in social media, you can see there's a lot of people that understand that. 17:51.800 --> 17:57.820 The mindware gaps is where you don't really know things about your brain that maybe you should know. 17:57.820 --> 18:04.260 So again, you make decisions with gaps in your knowledge and your understanding of things. 18:05.140 --> 18:07.140 Any questions or comments there? 18:07.620 --> 18:10.020 Alright, so that's enough theory. 18:11.740 --> 18:14.280 So how can I use this as a tool? 18:14.280 --> 18:19.060 How can I use the framework I just talked about as a tool, as a defender's tool? 18:20.760 --> 18:33.660 Well, in the recon and scan phase, can I draw the attacker into the attack surface with, say, planning a known vulnerability? 18:34.100 --> 18:51.080 There's some honeypot kinds of things here, but could I go, hey, I'm going to put a vulnerability out there for the bad guy to see, or gal, in hopes that they're going to use one of these biases and go, yeah, I got them. 18:51.080 --> 18:52.200 I'm in control. 18:52.400 --> 18:55.940 So if you look here, I mean, there's a couple of great biases here, right? 18:57.520 --> 19:00.160 So this one here is about representativeness. 19:00.240 --> 19:06.020 It's about using a model without understanding the probability of that model actually producing results, right? 19:06.020 --> 19:08.840 So you can go, I believe this is going to be the answer. 19:09.660 --> 19:14.080 But the probability of that actually being true is one in a hundred or one in a thousand. 19:14.200 --> 19:16.880 But it doesn't matter because you're like, well, I like that model. 19:17.660 --> 19:19.160 So that's a bias, right? 19:19.160 --> 19:24.340 So if I show you something that goes, hey, this Apache server is vulnerable. 19:25.120 --> 19:26.720 They haven't patched it. 19:26.980 --> 19:28.420 And you go, I got them. 19:29.780 --> 19:30.780 Do you? 19:31.600 --> 19:32.640 We'll see. 19:34.500 --> 19:35.900 Illusion of control. 19:36.520 --> 19:38.460 Overestimating your abilities. 19:39.960 --> 19:43.820 Believing that you are in control at all times. 19:44.600 --> 19:46.300 I was a fighter pilot. 19:46.920 --> 19:50.420 We suffered from something called the delusion of determinacy. 19:51.560 --> 19:52.680 What does that mean? 19:52.680 --> 19:56.400 It means that I went out and did something really, really dangerous. 19:57.060 --> 20:04.320 And I believed I could do that really dangerous thing because I could control the dangerous environment. 20:04.780 --> 20:06.720 Can I control the dangerous environment? 20:06.720 --> 20:07.940 Not really. 20:08.400 --> 20:15.040 But I told myself, in my reflective mind, I'm in control. 20:15.240 --> 20:17.440 The airplane's not flying me. 20:17.960 --> 20:21.400 And I'm going to kill all the bad guys and they're not going to kill me. 20:21.400 --> 20:28.620 And you have to tell yourself that in combat because otherwise they will take over you. 20:28.780 --> 20:33.300 It's called the delusion of determinacy. 20:34.460 --> 20:40.680 And it is a delusion, but it's one that you need to cope with the environment you're finding yourself in. 20:41.860 --> 20:43.380 Confirmation bias. 20:45.500 --> 20:50.000 Not recognizing the outlier data or other data that makes sense. 20:50.080 --> 20:52.180 And going, I got this, man. 20:52.180 --> 20:53.620 I mean, this is the way it always is. 20:53.620 --> 20:55.760 And I see it again, so it must be right. 20:57.360 --> 20:58.780 I can leverage that. 21:00.400 --> 21:04.100 Taking greater risk when you perceive increased risk or safety. 21:04.800 --> 21:06.980 That also is something I can manipulate, right? 21:06.980 --> 21:08.800 So I can go, oh yeah, it's okay, come on in. 21:08.800 --> 21:10.300 I got you, man, you're good. 21:11.120 --> 21:13.000 So you take more risk. 21:13.220 --> 21:15.220 When you probably shouldn't. 21:16.520 --> 21:19.760 The virgin ambiguity, that's something that came out of my research. 21:19.760 --> 21:24.760 It's definitely a core soft skill trait of high-end hackers. 21:26.280 --> 21:31.640 There is a requirement for structure and understanding. 21:31.640 --> 21:38.980 But the other thing that's interesting that my research showed is that there's also a high level of risk acceptance. 21:40.960 --> 21:43.040 Which you don't normally find in human beings. 21:43.040 --> 21:48.560 If you're someone that is very process-oriented, you're not likely to take high risks. 21:49.080 --> 21:53.560 But in your community, the opposite is true. 21:54.240 --> 21:56.540 You require structure and process. 21:57.220 --> 21:59.660 You also are willing to take great risks. 21:59.660 --> 22:02.600 And have a tendency to be a bit of a rebel. 22:02.640 --> 22:04.900 So look around, how many rebels in the room? 22:05.420 --> 22:06.940 I'm one, for sure. 22:09.400 --> 22:11.820 And then that sunk cost fallacy. 22:13.280 --> 22:16.140 I gotta double down on this, man, I got this. 22:16.140 --> 22:20.920 Even though it's costing me a lot of pain, I'm gonna keep going because I got this. 22:21.460 --> 22:22.340 Okay. 22:23.780 --> 22:32.980 The other thing that you have to understand to draw them in is you have to know a little something about the interest of the APT or attacker. 22:33.100 --> 22:35.080 And you have to understand their TTP. 22:35.080 --> 22:37.520 So what are their standard TTPs? 22:38.500 --> 22:41.140 How do they normally prosecute a target? 22:41.260 --> 22:47.340 Can I use that to my advantage by sucking them into an area, to an attack surface that I want them to come after? 22:48.840 --> 22:54.340 And then, is there any prior profiling or footprinting of that particular attacker? 22:54.640 --> 22:58.820 All those things go into the calculus of how I draw them into my honeypot. 23:04.730 --> 23:11.390 Once you're in, once they come in, I've drawn them in now using the kind of generalized things. 23:11.390 --> 23:13.970 I'm now gonna put them through an obstacle course. 23:15.430 --> 23:24.330 That obstacle course is designed to put them through part task exercises that allow me to suss out their cognitive vulnerability. 23:24.330 --> 23:27.710 So are they conducive to loss aversion? 23:27.710 --> 23:30.170 Are they conducive to representative bias? 23:30.170 --> 23:36.850 Are they conducive to this sunk cost or loss gain fallacy? 23:37.510 --> 23:50.150 Once I understand those things by putting them through this obstacle course, now I can manipulate the structure of the network to channel them to where I want them to go. 23:51.710 --> 24:13.570 And I can use that to develop these things called Cyber Psychology Informed Defenses, which are a combination of sensors and triggers that I can put in like a routine to go after the attacker once they've gone through my obstacle course and I've identified what their vulnerabilities are. 24:14.310 --> 24:16.970 The other thing I'm using is hypergames. 24:16.970 --> 24:18.870 Anybody familiar with what a hypergame is? 24:21.130 --> 24:27.390 So a hypergame occurs when one player doesn't fully understand all the strategies of the game. 24:27.890 --> 24:34.310 So the logic of that is, as the defender, I understand the logic of the game. 24:34.470 --> 24:39.130 The attacker doesn't know that I'm pwning them. 24:39.470 --> 24:48.470 So that model is an outstanding game logic approach when one side doesn't know the rules as well as the other. 24:54.690 --> 25:00.610 So this is an example of a system overview of how I would build this tool. 25:02.910 --> 25:05.950 The attacker comes in and does a recon and scan. 25:06.350 --> 25:09.950 They find a vulnerability that I planted in there intentionally. 25:09.950 --> 25:23.850 And again, it goes back to what are the generalized biases that I can take advantage of, what are the enemy TTPs that I can take advantage of, what are the profiling, what are the cultural habituses of the profile of the person that I think is trying to attack me, 25:23.850 --> 25:27.850 and how do I suck them into this particular approach. 25:29.990 --> 25:33.270 And I'm just going to use this decoy Apache server. 25:33.290 --> 25:43.890 And the mission here is, an APT has been asked to go after sensitive data about a stealth fighter on a contractor's site. 25:45.670 --> 25:47.590 So they're coming after me. 25:47.590 --> 25:50.570 I don't have to draw them in too badly, so I know they're coming. 25:50.990 --> 25:56.550 So it's not so hard for me to go, I kind of know who the APTs are that might want to do that. 25:56.570 --> 26:06.530 And so how do I put something out there that's discoverable in their reconnaissance and scanning that draws them into a point of attack that I'd like to see them attack. 26:07.970 --> 26:11.430 Once they're in, I would use some type of intrusion token. 26:11.430 --> 26:13.070 So I'm not going to rely on the IDS. 26:13.070 --> 26:19.230 I'm going to use some type of intrusion token that trips and tells me they're in the network. 26:19.310 --> 26:25.190 And once I know they're in the network, then I channel them off into my obstacle course. 26:25.610 --> 26:32.930 And I put them through a series of exercises to suss out those cognitive biases that we just talked about. 26:33.830 --> 26:44.270 And once I know what those cognitive biases are, customized to that particular attacker, I can now chart to channel them into the things that I want them to go after. 26:45.910 --> 27:02.810 The thing that's really important in here, and you can see here there's a game controller and reasoner, there's a set of cognitive models, and there's a set of these psychologically informed defenses that all feed my game reasoner and provide feedback into my cognitive models that I've developed. 27:02.810 --> 27:10.490 It's going to take about three years of human research to develop both this databank and that one. 27:11.790 --> 27:14.270 That's what we're looking at right now. 27:14.290 --> 27:32.370 But once I have that developed, then my game controller and reasoner controls and rheostats how I apply those psychological defenses based upon the feedback that I'm getting as they proceed through the phases of a hack and also what I've learned about them as individuals. 27:32.370 --> 27:35.950 Now, the interesting thing is, sometimes people come in scripted, right? 27:35.950 --> 27:38.110 So I have to break that script. 27:38.630 --> 27:43.490 I have to get a human intervention to occur so that I can go after that vulnerability. 27:44.350 --> 27:46.170 So that's going to be a hard point. 27:46.170 --> 27:48.410 I'll take some feedback on how I might do that. 27:48.850 --> 28:00.950 The second thing is, a lot of times a lower-ended APT might be the human on the keyboard, and when they run into something tough, they're going to bring in someone that's more experienced. 28:00.950 --> 28:16.990 So the game controller and reasoner and my obstacle course have to be able to understand that the APT just upped their level of competence and that the vulnerabilities that I thought about exploiting no longer exist for that individual because it's a different person. 28:17.150 --> 28:20.550 So that needs to be built into the capability as well. 28:21.590 --> 28:29.690 In this particular scenario, there's also a defensive display that tells defenders what's going on, and this is all automated, so you just follow it. 28:29.690 --> 28:32.070 As a defender, you're following what it is doing. 28:32.390 --> 28:40.270 You can intervene if you want to, but for the most part, this thing is using AI and this game engine to control what's happening to the attacker. 28:42.730 --> 28:48.910 As they move laterally in the system and achieve their action on objectives, there's a couple of things we could do. 28:48.910 --> 28:58.990 One of them is, we can poison the data so they can get some that looks realistic, but for the most part, it's poison, but at their level, they won't be able to determine that. 28:58.990 --> 29:06.150 So that requires them to exfiltrate bad data, take them a couple of weeks to analyze and go, oh, we got screwed, and start all over again. 29:06.150 --> 29:10.390 Because the objective here is not to stop the attack, it's to deny or degrade it. 29:11.410 --> 29:19.930 To put a cyber penalty on their ability to operate in your network while the defender remains in control of what they're doing. 29:21.090 --> 29:32.030 Another thing we've talked about is, there's a way in which you can actually show them the real data, but when they go to actually save it and exfiltrate it, it goes to a garbage file. 29:32.310 --> 29:33.830 And they exfiltrate garbage. 29:34.170 --> 29:40.650 Again, those things will not be determined until after they've had a chance to analyze what they took from your network. 29:41.730 --> 29:47.450 So, that's basically how this system is conceptualized from an operational view. 29:48.250 --> 29:51.070 Now let's go to some questions and comments. 29:52.110 --> 29:55.690 So, I'll open it up to you. 29:56.130 --> 29:58.970 If you could come up to the mic, I think that mic's hot. 29:59.170 --> 30:04.050 Come up to the mic and ask your question, and then let's talk about it. 30:04.230 --> 30:11.410 So, the first question I have here for you, do you think this has implications for future cyber defense? 30:11.410 --> 30:14.470 Is this an approach that makes sense to you? 30:15.210 --> 30:16.010 Anybody? 30:17.150 --> 30:18.450 I'm getting head nods. 30:21.090 --> 30:21.870 You got a question? 30:21.870 --> 30:22.390 Cool. 30:22.390 --> 30:23.090 What do you got? 30:23.090 --> 30:25.090 Sure, I'll ask a question. 30:25.530 --> 30:40.690 So, for certain types of organizations, like if you're a Lockheed or somebody like that, and you have a really detailed knowledge of what an attacker might be going for, most organizations are not in that position. 30:40.970 --> 30:42.190 Most organizations are... 30:43.330 --> 30:47.230 Attackers don't attack organizations, they attack vulnerabilities. 30:47.230 --> 30:52.090 And then they just figure out, well, who is attached to this vulnerability and how can I exploit them? 30:52.090 --> 30:57.230 So, that's slightly different if you have your stealth fighter or something that's at stake. 30:57.230 --> 31:03.510 But for a lot of organizations in medium to small businesses, they don't have that. 31:04.270 --> 31:16.970 Are there tools or ideas in here that are helpful to someone who is going to be attacked by the mob, not by James Bond? 31:17.950 --> 31:20.430 Yeah, so that's a good question. 31:20.630 --> 31:27.550 And I will tell you, the customer in this particular case was definitely focused on APTs. 31:27.750 --> 31:32.370 Definitely focused on the kinds of things that APTs are interested in. 31:32.470 --> 31:44.510 And it wasn't generally thinking about, well, if I'm just coming in here, if I'm a script kiddie, am I just coming in here and just trying everything that I can to mess with it and steal something? 31:44.510 --> 31:48.190 I mean, that's not exactly the threat they were talking about. 31:48.190 --> 31:51.610 I do think there are some things you can do. 31:52.570 --> 31:56.610 A script kiddie is kind of hard because they're not really doing much thinking, are they? 31:57.850 --> 31:59.110 They're just following a script. 31:59.110 --> 32:00.110 They don't know what the hell they're doing. 32:00.110 --> 32:02.690 They're just following a script and seeing what happens. 32:03.030 --> 32:03.990 I guess. 32:03.990 --> 32:16.630 But if those script kiddies are, for example, Russian malware operators, typically what you'll see is an attack starts with a script kiddie. 32:16.690 --> 32:19.210 That's your initial access person. 32:19.210 --> 32:24.990 But they're going to broker that access off to someone else who maybe does have very clear motivations. 32:25.410 --> 32:30.290 But you don't necessarily know what they're after or why. 32:30.290 --> 32:32.930 If it's ransomware, that's pretty obvious. 32:32.930 --> 32:36.870 And some of those ransomware operators are very, very advanced. 32:36.870 --> 32:40.030 Their motivation is known, but it's hard to... 32:41.570 --> 32:47.810 The psychology of that organization is different from the psychology of the person who infiltrated you. 32:48.030 --> 32:49.130 I would agree with that. 32:49.130 --> 32:50.390 So I think there's a couple of things. 32:50.390 --> 32:53.950 One, that's why the obstacle course is there. 32:53.950 --> 32:57.910 Because it's an opportunity for you to observe the attacker. 32:58.270 --> 33:00.370 What is the attacker doing? 33:00.470 --> 33:02.430 What things are they looking at? 33:02.430 --> 33:05.190 The cognitive model part of this... 33:08.930 --> 33:14.130 So if you're a ransomware person, that behavior is modeled in here. 33:14.550 --> 33:30.830 So if it sees that profile, if it sees what would be the typical kind of TTP, tactic, techniques, and procedures of someone doing ransomware, then that cognitive model talks to the game controller and pulls those defenses from the logic bank. 33:31.890 --> 33:36.010 This is part of the secret sauce. 33:36.170 --> 33:42.250 Building those cyber-cognitive computational models is not easy. 33:42.250 --> 33:44.210 There are some databases that you can use. 33:44.210 --> 33:47.810 I think the public-facing ones aren't very good. 33:47.970 --> 33:53.290 But there's obviously some others that could be leveraged that would be used to inform this cognitive model. 33:53.290 --> 33:57.270 So here's the typical behavior of somebody doing ransomware. 33:57.270 --> 34:00.590 All right, likely a ransomware, let's try something. 34:00.590 --> 34:03.870 And then this game controller and reasoner says, well, how did that work? 34:04.130 --> 34:04.910 Did I do good? 34:04.910 --> 34:05.950 Did I do bad? 34:06.430 --> 34:09.410 Are they taking my bait or not taking my bait? 34:09.850 --> 34:12.390 So I do think your point is valid. 34:12.390 --> 34:22.050 And I do think that this will need some tweaking to be a general defensive kind of tool across a corporate space where maybe you don't know exactly what they're after. 34:22.050 --> 34:28.670 But a lot of times it's either corporate espionage, ransomware, also money. 34:29.190 --> 34:31.490 I mean, there's only a few motives. 34:32.070 --> 34:33.070 There's a few. 34:33.070 --> 34:36.790 There's also some that just because it's there, they want to attack your system. 34:36.790 --> 34:41.970 That's a little harder person to deal with because they're just trying to say, well, can I mess with these people? 34:43.770 --> 34:45.170 But good questions. 34:45.170 --> 34:45.990 Thank you. 34:53.760 --> 34:56.600 So we talked a little bit about the viability of the approach. 34:56.600 --> 34:57.580 Anybody else? 34:57.580 --> 35:00.240 Any what I call bovine banderas? 35:00.240 --> 35:04.080 Anyone want to raise the bovine bandera flag and go, ah, no way, man. 35:04.080 --> 35:05.640 You're out to lunch. 35:05.640 --> 35:07.020 This isn't going to work. 35:07.340 --> 35:09.380 Anybody in the crowd think that? 35:14.820 --> 35:16.460 Did I make sense? 35:18.600 --> 35:26.640 I mean, what I think about this process is like a lot of times people do social engineering based on intuition, right? 35:26.640 --> 35:36.060 Based on, like, it's like taking a professional football scout and using that person's intuition about talent. 35:36.060 --> 35:44.980 Or taking the money ball route that says, hey, man, I can put some logic and reasoning and some algorithms to who I choose. 35:44.980 --> 35:46.360 I think this is the same thing. 35:46.360 --> 35:52.840 Rather than just leaving it to a random social engineering intuition kind of thing, I can put some science behind it. 35:52.840 --> 35:54.700 And I think that science is pretty powerful. 35:54.700 --> 35:58.160 And that's kind of the punchline of what my talk is. 35:58.180 --> 36:02.440 Like, guys, we can put some science against this if you understand how humans think. 36:02.820 --> 36:04.700 You have a good model of that. 36:04.700 --> 36:09.080 And then how do you identify vulnerabilities and then leverage those vulnerabilities? 36:09.480 --> 36:13.000 That's kind of where, that's the hypothesis here. 36:13.520 --> 36:17.920 I think we have a couple years to go before we prove that this can really work or not work. 36:18.720 --> 36:23.060 And there's a lot of human experimentation that needs to take place to prove that this really works. 36:23.280 --> 36:30.980 Like I said, there's early work that says there's merit, but not enough data, in my opinion, to really build a tool like this. 36:31.480 --> 36:37.640 And I wanted to bring this to this audience to kind of feel what, you know, see what you guys think about it. 36:39.240 --> 36:41.400 So, any other comments or questions? 36:43.240 --> 36:45.820 I mean, the last one is kind of be countered. 36:46.300 --> 36:52.900 So, if you know I'm messing with you, what would be your, as an attacker, what would be your strategy to counter what I'm doing? 36:55.120 --> 36:56.360 Ignore it, right? 36:56.360 --> 36:57.380 Ignore it. 36:57.760 --> 37:01.000 But you ignored it at your own risk, right? 37:01.280 --> 37:02.040 Sir? 37:02.820 --> 37:10.120 So, from a community standpoint, an open source standpoint... 37:10.120 --> 37:11.760 Can you put the mic a little closer? 37:11.760 --> 37:13.640 Yeah , this is a life problem, man. 37:13.640 --> 37:23.180 So, you know, from a community standpoint or an open source standpoint, a defender versus attacker, you know, gamifying it globally. 37:24.600 --> 37:27.480 Could we, as a community, do this? 37:27.520 --> 37:38.500 Could we, as a community, make a product or a project that would have value for everybody and still be effective against attackers who are aware of it? 37:39.360 --> 37:45.020 So, if I think, if what I heard you say is that, as a community, if you put this in play... 37:46.600 --> 37:49.480 Is it something that you think that has traction, right? 37:49.480 --> 37:50.600 Is that what you're asking? 37:50.620 --> 38:00.160 Yeah, basically, if somebody knows they're being gamed and there's a product that they can look under the hood, is it still effective? 38:00.920 --> 38:03.600 It's a good question, which is why I put in here... 38:04.780 --> 38:10.400 I think once this gets put in play, we are going to have to up our sophistication, right? 38:11.120 --> 38:20.740 The simple biases that I talked about, I mean, particularly as you go through the optical course, you go, what is this? 38:21.120 --> 38:25.720 Why am I having to go through these hoops to get to my objective? 38:26.200 --> 38:29.380 So, I look at it from a psychological standpoint, right? 38:29.380 --> 38:36.240 Let's say you're dating somebody and they're cheating on you, but you have no concept that they're cheating on you. 38:36.240 --> 38:41.360 You're inherently more trusting, more open, more accepting. 38:41.460 --> 38:51.000 However, once you have knowledge that a particular game is being played, your biases change and your ability to be manipulated has changed. 38:51.000 --> 38:52.480 So , I guess that's kind of why I'm asking. 38:52.480 --> 39:09.640 Yeah, so in some ways, what we saw in the Tularosa study is that the attacker didn't know when they were being messed with, which created doubt, self-doubt about what they were doing. 39:10.980 --> 39:18.620 And even if it's like saying, you can play the game the other way too, like, yeah, I got a deception tactic in here and not have one. 39:18.620 --> 39:21.040 You still cause the same friction. 39:21.320 --> 39:30.860 Because now the person, particularly like we talked about, this illusion of control bias that is pretty common in this community, right? 39:30.960 --> 39:33.700 And now all of a sudden that control is being questioned. 39:34.600 --> 39:38.000 It puts friction into the system and that's really what this is designed to do. 39:38.000 --> 39:40.880 It's really about friction and frustration. 39:41.180 --> 39:43.720 Imposing a cyber penalty on the attacker. 39:43.720 --> 39:46.080 Not making it so damn easy. 39:46.140 --> 39:49.500 And also putting the defender on a more offensive stance. 39:49.860 --> 40:06.360 In my dissertation, I interviewed someone that when an attacker would do an initial scan and they would see it was a Microsoft system, the next time she saw that attacker in the network, she would purposely send them a Linux prompt. 40:06.360 --> 40:08.280 Their freaking heads would explode. 40:08.280 --> 40:09.860 They're like, what the hell happened? 40:09.920 --> 40:11.320 What's wrong with my tools? 40:11.380 --> 40:12.720 Look, I just did this. 40:12.840 --> 40:13.960 It's a Microsoft system. 40:13.960 --> 40:15.980 Why the hell am I getting a Linux prompt? 40:17.040 --> 40:17.440 Right? 40:17.440 --> 40:21.080 So she would mess with them. 40:21.300 --> 40:26.220 This was 2017, 2018, but she was already doing that. 40:26.420 --> 40:34.260 As a defender, she was already taking an offensive stance to mess with the attacker in a really interesting way. 40:35.020 --> 40:37.640 Alright, I'm getting the hook. 40:37.760 --> 40:39.400 You've been a great audience. 40:40.700 --> 40:43.900 I'm really happy with the feedback I got and thanks very much. 40:43.900 --> 40:44.680 Take care.