# MediaChunks

chunk_text:
0.00s - 4.00s | This text was transcribed using whisper model: large-v2 Thank you so much for sharing your attention with me today. 4.00s - 8.00s | The technology is not really working, but I'll explain what's on the slides, 8.00s - 11.00s | and you can download them if they don't get up here. 11.00s - 15.00s | So, I'm a law professor at Copenhagen Business School and Aalborg University, 15.00s - 20.00s | and I'm here to talk about hacking human behavior. 20.00s - 27.00s | I will talk about big tech arrogance, human ignorance, 27.00s - 32.00s | what human dignity can be used for, what to do about it, 32.00s - 34.00s | so that's what I'm going to talk about. 34.00s - 37.00s | Everything is based on the book you can see on the screen there. 37.00s - 43.00s | It's an orange book. I'll leave a copy at the Policy Village for you to see. 43.00s - 47.00s | So, the good thing is it's available online, and you can find the link on the slides 47.00s - 50.00s | whenever you get there. 50.00s - 55.00s | Okay, so you're there, so you have the link here, everything is working. 55.00s - 60.00s | So, first of all, what we're talking about here is also artificial intelligence, 60.00s - 65.00s | and if you look at the history of technology law, in the mid-90s, 65.00s - 70.00s | there was a lot of focus on copyright, because what was being digitalized 70.00s - 74.00s | back in the 90s was music, films, and so on. 74.00s - 77.00s | What happened next was that we got social media, 77.00s - 81.00s | and what happened with social media was that it was the human experience 81.00s - 84.00s | that got digitalized. 84.00s - 90.00s | And then the interest revolved around privacy, personal data. 90.00s - 94.00s | And now with the latest hype of artificial intelligence, 94.00s - 102.00s | we see that the focus in law is on copyright and privacy once again, 102.00s - 105.00s | so these two areas, so that's curious. 105.00s - 110.00s | So, the conclusions, to start with them, Norbert Wiener said it very nice, 110.00s - 116.00s | more than 75 years ago, that what we have with artificial intelligence 116.00s -


chunk_text:
you have the link here, everything is working. 55.00s - 60.00s | So, first of all, what we're talking about here is also artificial intelligence, 60.00s - 65.00s | and if you look at the history of technology law, in the mid-90s, 65.00s - 70.00s | there was a lot of focus on copyright, because what was being digitalized 70.00s - 74.00s | back in the 90s was music, films, and so on. 74.00s - 77.00s | What happened next was that we got social media, 77.00s - 81.00s | and what happened with social media was that it was the human experience 81.00s - 84.00s | that got digitalized. 84.00s - 90.00s | And then the interest revolved around privacy, personal data. 90.00s - 94.00s | And now with the latest hype of artificial intelligence, 94.00s - 102.00s | we see that the focus in law is on copyright and privacy once again, 102.00s - 105.00s | so these two areas, so that's curious. 105.00s - 110.00s | So, the conclusions, to start with them, Norbert Wiener said it very nice, 110.00s - 116.00s | more than 75 years ago, that what we have with artificial intelligence 116.00s - 120.00s | or thinking machines, as he talked about, was akin to the atomic bomb, 120.00s - 123.00s | he compared to the atomic bomb back then. 123.00s - 126.00s | What he also said was that when we have technology, it's going to be used, 126.00s - 130.00s | so it's not going to go away, so that is also something we can rely on. 130.00s - 134.00s | And the last thing, which is the most important thing, is that the solution 134.00s - 138.00s | is to think about something else than just buying and selling. 138.00s - 143.00s | Market economy, but think about humanity instead of that. 143.00s - 147.00s | And what is also interesting is that this book that came out, 147.00s - 152.00s | Norbert Wiener came out in 1948, which was also the year that we got 152.00s - 157.00s | the UN Declaration of Human Rights, that speaks about human dignity. 157.00s - 161.00s | So, this is an old story being told again. 161.00s - 166.00s | So, the first thing we should recognize is that when we are talking about 166.00s - 170.00s | data and AI, they


chunk_text:
120.00s | or thinking machines, as he talked about, was akin to the atomic bomb, 120.00s - 123.00s | he compared to the atomic bomb back then. 123.00s - 126.00s | What he also said was that when we have technology, it's going to be used, 126.00s - 130.00s | so it's not going to go away, so that is also something we can rely on. 130.00s - 134.00s | And the last thing, which is the most important thing, is that the solution 134.00s - 138.00s | is to think about something else than just buying and selling. 138.00s - 143.00s | Market economy, but think about humanity instead of that. 143.00s - 147.00s | And what is also interesting is that this book that came out, 147.00s - 152.00s | Norbert Wiener came out in 1948, which was also the year that we got 152.00s - 157.00s | the UN Declaration of Human Rights, that speaks about human dignity. 157.00s - 161.00s | So, this is an old story being told again. 161.00s - 166.00s | So, the first thing we should recognize is that when we are talking about 166.00s - 170.00s | data and AI, they don't have any intrinsic value. 170.00s - 174.00s | I can have full data sets of all of you on a USB stick, 174.00s - 179.00s | and it doesn't have any value before I start using it. 179.00s - 184.00s | So, what we should be curious about is, what is the technology being used for? 184.00s - 187.00s | That is why my focus has been on data-driven business models 187.00s - 189.00s | rather than the technology. 189.00s - 192.00s | And I would argue that what we see with artificial intelligence 192.00s - 195.00s | is just the same as what we've seen with data-driven business models. 195.00s - 198.00s | So, it's been a dress rehearsal for more than a decade 198.00s - 202.00s | that we have used technology for manipulation, 202.00s - 207.00s | and it's just been exacerbated by new technology in AI. 207.00s - 211.00s | So, what we should be curious about is, what incentives are there? 211.00s - 214.00s | And when it comes to personalized marketing, 214.00s - 216.00s | there are basically three incentives that businesses have. 216.00s - 219.00s | They want to earn money, but


chunk_text:
don't have any intrinsic value. 170.00s - 174.00s | I can have full data sets of all of you on a USB stick, 174.00s - 179.00s | and it doesn't have any value before I start using it. 179.00s - 184.00s | So, what we should be curious about is, what is the technology being used for? 184.00s - 187.00s | That is why my focus has been on data-driven business models 187.00s - 189.00s | rather than the technology. 189.00s - 192.00s | And I would argue that what we see with artificial intelligence 192.00s - 195.00s | is just the same as what we've seen with data-driven business models. 195.00s - 198.00s | So, it's been a dress rehearsal for more than a decade 198.00s - 202.00s | that we have used technology for manipulation, 202.00s - 207.00s | and it's just been exacerbated by new technology in AI. 207.00s - 211.00s | So, what we should be curious about is, what incentives are there? 211.00s - 214.00s | And when it comes to personalized marketing, 214.00s - 216.00s | there are basically three incentives that businesses have. 216.00s - 219.00s | They want to earn money, but what correlates with earning money, 219.00s - 221.00s | making profits? 221.00s - 223.00s | That is, getting as many users as possible. 223.00s - 225.00s | That's why you want to have the network effect. 225.00s - 228.00s | So, you're going to be the winner that takes it all. 228.00s - 231.00s | You also want to have more attention. 231.00s - 234.00s | So, the more addictive you can make your platform, 234.00s - 236.00s | the more attention you will get, 236.00s - 238.00s | and the more advertising dollars you can get. 238.00s - 240.00s | And the last thing what you want to have 240.00s - 243.00s | is as much data as possible of each individual, 243.00s - 246.00s | because the more you know of each individual, 246.00s - 249.00s | the higher price you can charge for the advertising. 250.00s - 253.00s | And what is new with generative AI is basically 253.00s - 256.00s | that the businesses also have an interest 256.00s - 258.00s | in getting as much content as possible. 258.00s - 261.00s | That is why we see social media platforms 261.00s - 266.00s | trying


chunk_text:
what correlates with earning money, 219.00s - 221.00s | making profits? 221.00s - 223.00s | That is, getting as many users as possible. 223.00s - 225.00s | That's why you want to have the network effect. 225.00s - 228.00s | So, you're going to be the winner that takes it all. 228.00s - 231.00s | You also want to have more attention. 231.00s - 234.00s | So, the more addictive you can make your platform, 234.00s - 236.00s | the more attention you will get, 236.00s - 238.00s | and the more advertising dollars you can get. 238.00s - 240.00s | And the last thing what you want to have 240.00s - 243.00s | is as much data as possible of each individual, 243.00s - 246.00s | because the more you know of each individual, 246.00s - 249.00s | the higher price you can charge for the advertising. 250.00s - 253.00s | And what is new with generative AI is basically 253.00s - 256.00s | that the businesses also have an interest 256.00s - 258.00s | in getting as much content as possible. 258.00s - 261.00s | That is why we see social media platforms 261.00s - 266.00s | trying to use our content to train their AI models on. 266.00s - 271.00s | That is part of what we can talk about 271.00s - 275.00s | when we say big tech arrogance, but I'll come back to that. 276.00s - 278.00s | Yes. 278.00s - 281.00s | So, in liberal democracies and in markets, 281.00s - 284.00s | we have the idea of empowerment. 284.00s - 286.00s | So, as citizens, we should be empowered 286.00s - 289.00s | to be part of society. 289.00s - 292.00s | In markets, we should be able to make rational choices 292.00s - 294.00s | following our goals, values, and preferences 294.00s - 296.00s | that may be different from each of us, 296.00s - 298.00s | but we should be free individuals. 298.00s - 300.00s | We should be empowered. 300.00s - 303.00s | And that is what I will challenge in this talk to begin with. 303.00s - 306.00s | So, what I came up to in my research is that 306.00s - 308.00s | there are three things that need to be in place 308.00s - 311.00s | in order to talk meaningfully about empowerment. 311.00s - 313.00s |


chunk_text:
to use our content to train their AI models on. 266.00s - 271.00s | That is part of what we can talk about 271.00s - 275.00s | when we say big tech arrogance, but I'll come back to that. 276.00s - 278.00s | Yes. 278.00s - 281.00s | So, in liberal democracies and in markets, 281.00s - 284.00s | we have the idea of empowerment. 284.00s - 286.00s | So, as citizens, we should be empowered 286.00s - 289.00s | to be part of society. 289.00s - 292.00s | In markets, we should be able to make rational choices 292.00s - 294.00s | following our goals, values, and preferences 294.00s - 296.00s | that may be different from each of us, 296.00s - 298.00s | but we should be free individuals. 298.00s - 300.00s | We should be empowered. 300.00s - 303.00s | And that is what I will challenge in this talk to begin with. 303.00s - 306.00s | So, what I came up to in my research is that 306.00s - 308.00s | there are three things that need to be in place 308.00s - 311.00s | in order to talk meaningfully about empowerment. 311.00s - 313.00s | First, we need agency. 313.00s - 316.00s | Some capability to understand and act in the world 316.00s - 318.00s | that we are living in. 318.00s - 321.00s | We need to have some sort of transparency. 321.00s - 324.00s | And then we, of course, need the absence of manipulation, 324.00s - 327.00s | because manipulation is the opposite of freedom. 327.00s - 329.00s | And if we start with agency, 329.00s - 331.00s | we can say we know from psychology 331.00s - 333.00s | that we are bounded rationally. 333.00s - 335.00s | That means that we are not completely rational 335.00s - 337.00s | in whatever we do. 337.00s - 340.00s | And there's been a lot of research in how we are irrational 340.00s - 343.00s | that can be used against us. 343.00s - 345.00s | When it comes to transparency, 345.00s - 347.00s | the only thing I will say now is that 347.00s - 350.00s | information and transparency is not the same. 350.00s - 352.00s | I'll come back to transparency soon, 352.00s - 354.00s | because that is key to what we are talking about. 354.00s - 357.00s |


chunk_text:
First, we need agency. 313.00s - 316.00s | Some capability to understand and act in the world 316.00s - 318.00s | that we are living in. 318.00s - 321.00s | We need to have some sort of transparency. 321.00s - 324.00s | And then we, of course, need the absence of manipulation, 324.00s - 327.00s | because manipulation is the opposite of freedom. 327.00s - 329.00s | And if we start with agency, 329.00s - 331.00s | we can say we know from psychology 331.00s - 333.00s | that we are bounded rationally. 333.00s - 335.00s | That means that we are not completely rational 335.00s - 337.00s | in whatever we do. 337.00s - 340.00s | And there's been a lot of research in how we are irrational 340.00s - 343.00s | that can be used against us. 343.00s - 345.00s | When it comes to transparency, 345.00s - 347.00s | the only thing I will say now is that 347.00s - 350.00s | information and transparency is not the same. 350.00s - 352.00s | I'll come back to transparency soon, 352.00s - 354.00s | because that is key to what we are talking about. 354.00s - 357.00s | The last thing, when we talk about absence of manipulation, 357.00s - 360.00s | I've borrowed a definition from Cass Sunstein 360.00s - 363.00s | when speaking about whether you're sufficiently engaging 363.00s - 365.00s | or appealing to the user's capacity 365.00s - 367.00s | for reflection and deliberation. 367.00s - 370.00s | Just think about you get a cookie consent pop-up 370.00s - 373.00s | and you get the choice between managed preferences 373.00s - 375.00s | and accept all. 375.00s - 377.00s | You would, of course, accept all, 377.00s - 380.00s | because there's less friction. 380.00s - 383.00s | So you could do a lot with design, 383.00s - 385.00s | and there's a lot of focus on design 385.00s - 387.00s | both in law and in technology. 387.00s - 391.00s | How do we design the reality we enter online? 391.00s - 394.00s | So this slide I've taken here 394.00s - 398.00s | just to signal or give you some insights 398.00s - 402.00s | into the toolbox of advertisers. 402.00s - 407.00s | These levels of influence are compiled by Sheldini, 407.00s - 410.00s | who is a professor in marketing.


chunk_text:
The last thing, when we talk about absence of manipulation, 357.00s - 360.00s | I've borrowed a definition from Cass Sunstein 360.00s - 363.00s | when speaking about whether you're sufficiently engaging 363.00s - 365.00s | or appealing to the user's capacity 365.00s - 367.00s | for reflection and deliberation. 367.00s - 370.00s | Just think about you get a cookie consent pop-up 370.00s - 373.00s | and you get the choice between managed preferences 373.00s - 375.00s | and accept all. 375.00s - 377.00s | You would, of course, accept all, 377.00s - 380.00s | because there's less friction. 380.00s - 383.00s | So you could do a lot with design, 383.00s - 385.00s | and there's a lot of focus on design 385.00s - 387.00s | both in law and in technology. 387.00s - 391.00s | How do we design the reality we enter online? 391.00s - 394.00s | So this slide I've taken here 394.00s - 398.00s | just to signal or give you some insights 398.00s - 402.00s | into the toolbox of advertisers. 402.00s - 407.00s | These levels of influence are compiled by Sheldini, 407.00s - 410.00s | who is a professor in marketing. 410.00s - 412.00s | And this is just to illustrate 412.00s - 415.00s | how easy it is to manipulate us. 415.00s - 418.00s | So if you take reciprocation, for instance, 418.00s - 421.00s | if we get something from a company or from a person, 421.00s - 424.00s | we feel obliged toward that person. 424.00s - 428.00s | So if you get a free Google Maps, that's great. 428.00s - 431.00s | You feel you're obliged to do something for Google. 431.00s - 433.00s | If you take scarcity, 433.00s - 436.00s | three other people are looking at this limited offer right now. 436.00s - 438.00s | Oh, we better buy it right now. 438.00s - 440.00s | So scarcity works. 440.00s - 442.00s | This is written down in books, 442.00s - 445.00s | so it's easy, accessible, but nobody reads it. 445.00s - 447.00s | So when we talk about markets, 447.00s - 449.00s | we want to make the distinction 449.00s - 451.00s | between persuasion and manipulation 451.00s - 453.00s | because in a market economy, 453.00s - 455.00s | we need to have marketing, 455.00s - 459.00s | and we need


chunk_text:
410.00s - 412.00s | And this is just to illustrate 412.00s - 415.00s | how easy it is to manipulate us. 415.00s - 418.00s | So if you take reciprocation, for instance, 418.00s - 421.00s | if we get something from a company or from a person, 421.00s - 424.00s | we feel obliged toward that person. 424.00s - 428.00s | So if you get a free Google Maps, that's great. 428.00s - 431.00s | You feel you're obliged to do something for Google. 431.00s - 433.00s | If you take scarcity, 433.00s - 436.00s | three other people are looking at this limited offer right now. 436.00s - 438.00s | Oh, we better buy it right now. 438.00s - 440.00s | So scarcity works. 440.00s - 442.00s | This is written down in books, 442.00s - 445.00s | so it's easy, accessible, but nobody reads it. 445.00s - 447.00s | So when we talk about markets, 447.00s - 449.00s | we want to make the distinction 449.00s - 451.00s | between persuasion and manipulation 451.00s - 453.00s | because in a market economy, 453.00s - 455.00s | we need to have marketing, 455.00s - 459.00s | and we need to be able to persuade consumers, 459.00s - 461.00s | but we should not manipulate them. 461.00s - 464.00s | And that is what I've spent almost 30 years of my life 464.00s - 466.00s | finding out where is the fine line 466.00s - 468.00s | between persuasion and manipulation. 468.00s - 471.47s | When it comes to technology, 471.47s - 475.47s | I should just add for behavior modification for marketing, 475.47s - 480.47s | the first book I've come across on scientific advertising 480.47s - 482.47s | is more than 100 years old. 482.47s - 485.47s | So this is an old discipline in manipulating people. 485.47s - 487.47s | It's definitely not new. 487.47s - 489.47s | A newer discipline is 489.47s - 492.47s | how can you use technology to persuade people? 492.47s - 495.47s | Some of you might be familiar with B.J. Fock, 495.47s - 499.47s | who wrote a book on persuasive technology or captology. 499.47s - 501.47s | How can you use computers 501.47s - 505.47s | to persuade people to buy stuff and do stuff? 505.47s - 507.47s | And what I'll just conclude here 507.47s - 509.47s | is


chunk_text:
to be able to persuade consumers, 459.00s - 461.00s | but we should not manipulate them. 461.00s - 464.00s | And that is what I've spent almost 30 years of my life 464.00s - 466.00s | finding out where is the fine line 466.00s - 468.00s | between persuasion and manipulation. 468.00s - 471.47s | When it comes to technology, 471.47s - 475.47s | I should just add for behavior modification for marketing, 475.47s - 480.47s | the first book I've come across on scientific advertising 480.47s - 482.47s | is more than 100 years old. 482.47s - 485.47s | So this is an old discipline in manipulating people. 485.47s - 487.47s | It's definitely not new. 487.47s - 489.47s | A newer discipline is 489.47s - 492.47s | how can you use technology to persuade people? 492.47s - 495.47s | Some of you might be familiar with B.J. Fock, 495.47s - 499.47s | who wrote a book on persuasive technology or captology. 499.47s - 501.47s | How can you use computers 501.47s - 505.47s | to persuade people to buy stuff and do stuff? 505.47s - 507.47s | And what I'll just conclude here 507.47s - 509.47s | is that design is extraordinarily powerful 509.47s - 512.47s | in how we can manipulate people. 512.47s - 514.47s | One of the things he mentioned 514.47s - 518.47s | is that computers can go where humans cannot go. 518.47s - 520.47s | So I would assume that most of you 520.47s - 523.47s | will have Amazon, Google, Facebook, etc. 523.47s - 525.47s | with you everywhere you go, 525.47s - 527.47s | in your bedroom, in your bathroom, and so on. 527.47s - 530.47s | So that is definitely a testament to the fact 530.47s - 534.47s | that you can go where nobody else can go. 534.47s - 536.47s | Also, another important thing, 536.47s - 538.47s | if you look into psychology, 538.47s - 542.47s | if you want to conclude on bounded rationality, 542.47s - 544.47s | the fact that we're not completely rational, 544.47s - 546.47s | the reason why we're not completely rational 546.47s - 548.47s | is because we are more emotional. 548.47s - 551.47s | A lot of the choices we make are emotional, 551.47s - 553.47s | and then we rationalize them afterwards. 553.47s - 555.47s | And the interesting thing


chunk_text:
that design is extraordinarily powerful 509.47s - 512.47s | in how we can manipulate people. 512.47s - 514.47s | One of the things he mentioned 514.47s - 518.47s | is that computers can go where humans cannot go. 518.47s - 520.47s | So I would assume that most of you 520.47s - 523.47s | will have Amazon, Google, Facebook, etc. 523.47s - 525.47s | with you everywhere you go, 525.47s - 527.47s | in your bedroom, in your bathroom, and so on. 527.47s - 530.47s | So that is definitely a testament to the fact 530.47s - 534.47s | that you can go where nobody else can go. 534.47s - 536.47s | Also, another important thing, 536.47s - 538.47s | if you look into psychology, 538.47s - 542.47s | if you want to conclude on bounded rationality, 542.47s - 544.47s | the fact that we're not completely rational, 544.47s - 546.47s | the reason why we're not completely rational 546.47s - 548.47s | is because we are more emotional. 548.47s - 551.47s | A lot of the choices we make are emotional, 551.47s - 553.47s | and then we rationalize them afterwards. 553.47s - 555.47s | And the interesting thing about computers 555.47s - 558.47s | is that it can actually evoke feelings. 558.47s - 561.47s | So when you open your computer and you get a smiley, 561.47s - 563.47s | you feel better with yourself. 563.47s - 566.47s | That's how easy we are to persuade and manipulate. 566.47s - 569.47s | And if you fuse BJ Fogg with Cialdini, 569.47s - 571.47s | we get online influence. 571.47s - 573.47s | We get Cialdini on steroids 573.47s - 576.47s | because you can actually use the technology 576.47s - 579.47s | to apply the levels of influence. 579.47s - 581.47s | The good thing about being in academia 581.47s - 583.47s | is that you decide yourselves which books to read. 583.47s - 585.47s | And I thought it would be interesting 585.47s - 587.47s | to read books on magic. 587.47s - 589.47s | And it actually turns out that 589.47s - 591.47s | the two foundations of magic 591.47s - 593.47s | is misdirection 593.47s - 596.47s | and the impression of having a choice. 596.47s - 598.47s | And that's what's going on here. 598.47s - 600.47s | That's why we could say it's


chunk_text:
about computers 555.47s - 558.47s | is that it can actually evoke feelings. 558.47s - 561.47s | So when you open your computer and you get a smiley, 561.47s - 563.47s | you feel better with yourself. 563.47s - 566.47s | That's how easy we are to persuade and manipulate. 566.47s - 569.47s | And if you fuse BJ Fogg with Cialdini, 569.47s - 571.47s | we get online influence. 571.47s - 573.47s | We get Cialdini on steroids 573.47s - 576.47s | because you can actually use the technology 576.47s - 579.47s | to apply the levels of influence. 579.47s - 581.47s | The good thing about being in academia 581.47s - 583.47s | is that you decide yourselves which books to read. 583.47s - 585.47s | And I thought it would be interesting 585.47s - 587.47s | to read books on magic. 587.47s - 589.47s | And it actually turns out that 589.47s - 591.47s | the two foundations of magic 591.47s - 593.47s | is misdirection 593.47s - 596.47s | and the impression of having a choice. 596.47s - 598.47s | And that's what's going on here. 598.47s - 600.47s | That's why we could say it's kind of magic. 600.47s - 603.47s | So where does that all lead? 603.47s - 606.47s | It leads to information asymmetries. 606.47s - 607.47s | This is not new. 607.47s - 609.47s | What I've done in my book is 609.47s - 613.47s | I developed the model of information asymmetry. 613.47s - 617.47s | So Akerlof wrote in 1970 an article 617.47s - 620.47s | about information asymmetry. 620.47s - 623.47s | That is what I call Tier 1 information asymmetry. 623.47s - 625.47s | The fact that the seller knows much more 625.47s - 628.47s | about him or herself than the buyer 628.47s - 630.47s | and also about the product. 630.47s - 632.47s | So if I'm going to sell my used car to you, 632.47s - 634.47s | I know everything about it, you know nothing. 634.47s - 637.47s | In law, we solve that with information. 637.47s - 639.47s | I have a duty to inform you about 639.47s - 641.47s | the condition of the car. 641.47s - 644.47s | And if I fail to do that, you can come after me. 644.47s - 648.47s | So that is the Tier 1


chunk_text:
kind of magic. 600.47s - 603.47s | So where does that all lead? 603.47s - 606.47s | It leads to information asymmetries. 606.47s - 607.47s | This is not new. 607.47s - 609.47s | What I've done in my book is 609.47s - 613.47s | I developed the model of information asymmetry. 613.47s - 617.47s | So Akerlof wrote in 1970 an article 617.47s - 620.47s | about information asymmetry. 620.47s - 623.47s | That is what I call Tier 1 information asymmetry. 623.47s - 625.47s | The fact that the seller knows much more 625.47s - 628.47s | about him or herself than the buyer 628.47s - 630.47s | and also about the product. 630.47s - 632.47s | So if I'm going to sell my used car to you, 632.47s - 634.47s | I know everything about it, you know nothing. 634.47s - 637.47s | In law, we solve that with information. 637.47s - 639.47s | I have a duty to inform you about 639.47s - 641.47s | the condition of the car. 641.47s - 644.47s | And if I fail to do that, you can come after me. 644.47s - 648.47s | So that is the Tier 1 information asymmetry. 648.47s - 650.47s | The Tier 2 information asymmetry 650.47s - 653.47s | is what the business know about how to persuade us. 653.47s - 656.47s | How to persuade people in general. 656.47s - 658.47s | That is Sheldini's technology. 658.47s - 660.47s | That is PJ Fox's technology 660.47s - 663.47s | on the techniques about how to influence people 663.47s - 666.47s | and using computers to do that. 666.47s - 668.47s | So that is Tier 2. 668.47s - 672.47s | Tier 3 is where we get information of each individual. 672.47s - 674.47s | That is where personal data come in. 674.47s - 676.47s | So if I don't see you as a whole crowd 676.47s - 679.47s | but see you as individuals 679.47s - 682.47s | and I have in my records 682.47s - 686.47s | thousands, hundreds of thousands, maybe millions of users. 686.47s - 688.47s | You can go into my shop 688.47s - 690.47s | and you can click a little bit around 690.47s - 694.47s | and I can easily find a group of people that match you. 694.47s - 696.47s | Meaning I can start creating


chunk_text:
information asymmetry. 648.47s - 650.47s | The Tier 2 information asymmetry 650.47s - 653.47s | is what the business know about how to persuade us. 653.47s - 656.47s | How to persuade people in general. 656.47s - 658.47s | That is Sheldini's technology. 658.47s - 660.47s | That is PJ Fox's technology 660.47s - 663.47s | on the techniques about how to influence people 663.47s - 666.47s | and using computers to do that. 666.47s - 668.47s | So that is Tier 2. 668.47s - 672.47s | Tier 3 is where we get information of each individual. 672.47s - 674.47s | That is where personal data come in. 674.47s - 676.47s | So if I don't see you as a whole crowd 676.47s - 679.47s | but see you as individuals 679.47s - 682.47s | and I have in my records 682.47s - 686.47s | thousands, hundreds of thousands, maybe millions of users. 686.47s - 688.47s | You can go into my shop 688.47s - 690.47s | and you can click a little bit around 690.47s - 694.47s | and I can easily find a group of people that match you. 694.47s - 696.47s | Meaning I can start creating 696.47s - 699.47s | an artificial intelligence model of you. 699.47s - 702.47s | So just a few clicks, I have a model of you 702.47s - 706.47s | and I can use that model to test how to better persuade you. 706.47s - 709.47s | So that is Tier 3 information asymmetry 709.47s - 712.47s | and that is why we should care about personal data, of course. 712.47s - 714.47s | One of the things we do with that 714.47s - 716.47s | is we create personalized realities. 716.47s - 718.47s | That means that my reality may be different 718.47s - 720.47s | from each of yours reality. 720.47s - 723.47s | That means that it is difficult to compare 723.47s - 726.47s | how we are being persuaded or manipulated. 726.47s - 729.47s | So how do we level that information asymmetry? 729.47s - 732.47s | Well, the first thing we should recognize, as I said earlier, 732.47s - 735.47s | information and transparency are two different things. 735.47s - 737.47s | So you use information, 737.47s - 741.47s | you communicate information to create transparency. 741.47s - 745.47s | And regulators have preferred to use


chunk_text:
696.47s - 699.47s | an artificial intelligence model of you. 699.47s - 702.47s | So just a few clicks, I have a model of you 702.47s - 706.47s | and I can use that model to test how to better persuade you. 706.47s - 709.47s | So that is Tier 3 information asymmetry 709.47s - 712.47s | and that is why we should care about personal data, of course. 712.47s - 714.47s | One of the things we do with that 714.47s - 716.47s | is we create personalized realities. 716.47s - 718.47s | That means that my reality may be different 718.47s - 720.47s | from each of yours reality. 720.47s - 723.47s | That means that it is difficult to compare 723.47s - 726.47s | how we are being persuaded or manipulated. 726.47s - 729.47s | So how do we level that information asymmetry? 729.47s - 732.47s | Well, the first thing we should recognize, as I said earlier, 732.47s - 735.47s | information and transparency are two different things. 735.47s - 737.47s | So you use information, 737.47s - 741.47s | you communicate information to create transparency. 741.47s - 745.47s | And regulators have preferred to use information 745.47s - 747.47s | as the regime to regulate markets 747.47s - 750.47s | because it is almost free to do. 751.47s - 755.47s | The problem is that if I'm obliged as a seller 755.47s - 757.47s | to give you information, 757.47s - 761.47s | your obligation will be to decode the information I've given to you. 761.47s - 764.47s | That means I put an extra burden on you. 764.47s - 766.47s | And we already have cognitive overload 766.47s - 768.47s | when we are on the Internet. 768.47s - 770.47s | So more information is not going to help us. 770.47s - 773.47s | So that is one thing we should realize about that. 773.47s - 776.47s | We should also realize that there's a lot of theory 776.47s - 778.47s | about frames and storytelling. 778.47s - 780.47s | Storytelling is how we understand the world. 780.47s - 782.47s | We understand the world in stories. 782.47s - 784.47s | So we tell each other stories 784.47s - 787.47s | and we are being told stories by businesses. 787.47s - 790.47s | And they are much better at making up stories 790.47s -


chunk_text:
information 745.47s - 747.47s | as the regime to regulate markets 747.47s - 750.47s | because it is almost free to do. 751.47s - 755.47s | The problem is that if I'm obliged as a seller 755.47s - 757.47s | to give you information, 757.47s - 761.47s | your obligation will be to decode the information I've given to you. 761.47s - 764.47s | That means I put an extra burden on you. 764.47s - 766.47s | And we already have cognitive overload 766.47s - 768.47s | when we are on the Internet. 768.47s - 770.47s | So more information is not going to help us. 770.47s - 773.47s | So that is one thing we should realize about that. 773.47s - 776.47s | We should also realize that there's a lot of theory 776.47s - 778.47s | about frames and storytelling. 778.47s - 780.47s | Storytelling is how we understand the world. 780.47s - 782.47s | We understand the world in stories. 782.47s - 784.47s | So we tell each other stories 784.47s - 787.47s | and we are being told stories by businesses. 787.47s - 790.47s | And they are much better at making up stories 790.47s - 792.47s | than we are ourselves. 792.47s - 797.47s | One of the things or more misleading stories that are out there 797.47s - 799.47s | is that we are paying with personal data. 799.47s - 802.47s | I would argue that that is a misleading story. 802.47s - 805.47s | It's a misleading framing of the situation, 805.47s - 807.47s | which I will come back to. 807.47s - 813.47s | So what we need to, as consumers, as regulators, and so on, 813.47s - 815.47s | is we need to understand the deal. 815.47s - 818.47s | So Article 22 of the GDPR 818.47s - 820.47s | speaks about automated decision-making. 820.47s - 823.47s | So that is the closest we get to regulation 823.47s - 826.47s | of applied artificial intelligence. 826.47s - 828.47s | And there the requirement is that you should 828.47s - 830.47s | explain the data subject about the logic, 830.47s - 833.47s | the significance, and envisage consequences. 833.47s - 835.47s | In my book, that is a gold standard 835.47s - 838.47s | for how you should inform people. 838.47s - 841.47s | Neil Postman, one of my heroes, 841.47s -


chunk_text:
792.47s | than we are ourselves. 792.47s - 797.47s | One of the things or more misleading stories that are out there 797.47s - 799.47s | is that we are paying with personal data. 799.47s - 802.47s | I would argue that that is a misleading story. 802.47s - 805.47s | It's a misleading framing of the situation, 805.47s - 807.47s | which I will come back to. 807.47s - 813.47s | So what we need to, as consumers, as regulators, and so on, 813.47s - 815.47s | is we need to understand the deal. 815.47s - 818.47s | So Article 22 of the GDPR 818.47s - 820.47s | speaks about automated decision-making. 820.47s - 823.47s | So that is the closest we get to regulation 823.47s - 826.47s | of applied artificial intelligence. 826.47s - 828.47s | And there the requirement is that you should 828.47s - 830.47s | explain the data subject about the logic, 830.47s - 833.47s | the significance, and envisage consequences. 833.47s - 835.47s | In my book, that is a gold standard 835.47s - 838.47s | for how you should inform people. 838.47s - 841.47s | Neil Postman, one of my heroes, 841.47s - 843.47s | wrote in the 80s and the 90s 843.47s - 846.47s | about technology and media. 846.47s - 848.47s | And what he said about technology 848.47s - 851.47s | is that everything we should know about technology 851.47s - 853.47s | is everything we should know about cars. 853.47s - 856.47s | It is not how we use the cars or the technology. 856.47s - 860.47s | It is how the technology or the cars are using us. 860.47s - 862.47s | That is what we should be curious about. 862.47s - 864.47s | Because that is where we can understand 864.47s - 867.47s | the price that we are paying when we get something for free. 869.47s - 873.47s | So what we need to understand is externalities. 873.47s - 877.47s | So externalities, if you imagine you have a factory making shoes 877.47s - 880.47s | and you have some waste from the shoe production 880.47s - 882.47s | and you just throw it in the river, 882.47s - 884.47s | that is an externality. 884.47s - 887.47s | The business will sell the shoes and get the money from them. 887.47s - 890.47s | But


chunk_text:
843.47s | wrote in the 80s and the 90s 843.47s - 846.47s | about technology and media. 846.47s - 848.47s | And what he said about technology 848.47s - 851.47s | is that everything we should know about technology 851.47s - 853.47s | is everything we should know about cars. 853.47s - 856.47s | It is not how we use the cars or the technology. 856.47s - 860.47s | It is how the technology or the cars are using us. 860.47s - 862.47s | That is what we should be curious about. 862.47s - 864.47s | Because that is where we can understand 864.47s - 867.47s | the price that we are paying when we get something for free. 869.47s - 873.47s | So what we need to understand is externalities. 873.47s - 877.47s | So externalities, if you imagine you have a factory making shoes 877.47s - 880.47s | and you have some waste from the shoe production 880.47s - 882.47s | and you just throw it in the river, 882.47s - 884.47s | that is an externality. 884.47s - 887.47s | The business will sell the shoes and get the money from them. 887.47s - 890.47s | But the rest of us will have to clean up 890.47s - 893.47s | of the disaster they made in the river. 893.47s - 895.47s | That is an externality. 895.47s - 897.47s | Think about big tech companies. 897.47s - 901.47s | How much damage, how much harm they are making to society 901.47s - 904.47s | that we have to clean up after them. 904.47s - 907.47s | So I think it makes sense to talk about externalities. 907.47s - 910.47s | So what are the harms? 910.47s - 912.47s | Well, first of all, you can say that 912.47s - 917.47s | the whole idea is of hacking or hijacking the human experience. 917.47s - 921.47s | And a lot of people talk about personalized marketing. 921.47s - 924.47s | What is the problem that I am going to buy something I don't need? 924.47s - 926.47s | We do that all the time. 926.47s - 928.47s | Well, it might not be such a big harm. 928.47s - 930.47s | Departing with your money, 930.47s - 932.47s | depending on how rich or how poor you are, 932.47s - 934.47s | of course, it makes a difference.


chunk_text:
the rest of us will have to clean up 890.47s - 893.47s | of the disaster they made in the river. 893.47s - 895.47s | That is an externality. 895.47s - 897.47s | Think about big tech companies. 897.47s - 901.47s | How much damage, how much harm they are making to society 901.47s - 904.47s | that we have to clean up after them. 904.47s - 907.47s | So I think it makes sense to talk about externalities. 907.47s - 910.47s | So what are the harms? 910.47s - 912.47s | Well, first of all, you can say that 912.47s - 917.47s | the whole idea is of hacking or hijacking the human experience. 917.47s - 921.47s | And a lot of people talk about personalized marketing. 921.47s - 924.47s | What is the problem that I am going to buy something I don't need? 924.47s - 926.47s | We do that all the time. 926.47s - 928.47s | Well, it might not be such a big harm. 928.47s - 930.47s | Departing with your money, 930.47s - 932.47s | depending on how rich or how poor you are, 932.47s - 934.47s | of course, it makes a difference. 934.47s - 936.47s | But what we should also care about 936.47s - 938.47s | is that it is not only commercial marketing we are talking about. 938.47s - 940.47s | We are talking about political marketing. 940.47s - 942.47s | We are talking about religious marketing. 942.47s - 945.47s | And that is where it gets a bit sketchy. 945.47s - 949.47s | We should also understand that we are being affected by technology, 949.47s - 951.47s | including artificial intelligence, 951.47s - 955.47s | as citizens, as workers, and as consumers. 955.47s - 958.47s | So every aspect of our life is being influenced 958.47s - 963.47s | by how technology around us is being designed and sold to us. 964.47s - 968.47s | So in the book, I divide the harms into three categories. 968.47s - 970.47s | I talk about personal harms, 970.47s - 973.47s | including people getting more lonely, 973.47s - 975.47s | which correlates with having bad health. 975.47s - 977.47s | We don't want people to be lonely. 977.47s - 979.47s | We are social animals. 979.47s - 983.47s | We also get worse at reading and understanding our attention span 983.47s


chunk_text:
934.47s - 936.47s | But what we should also care about 936.47s - 938.47s | is that it is not only commercial marketing we are talking about. 938.47s - 940.47s | We are talking about political marketing. 940.47s - 942.47s | We are talking about religious marketing. 942.47s - 945.47s | And that is where it gets a bit sketchy. 945.47s - 949.47s | We should also understand that we are being affected by technology, 949.47s - 951.47s | including artificial intelligence, 951.47s - 955.47s | as citizens, as workers, and as consumers. 955.47s - 958.47s | So every aspect of our life is being influenced 958.47s - 963.47s | by how technology around us is being designed and sold to us. 964.47s - 968.47s | So in the book, I divide the harms into three categories. 968.47s - 970.47s | I talk about personal harms, 970.47s - 973.47s | including people getting more lonely, 973.47s - 975.47s | which correlates with having bad health. 975.47s - 977.47s | We don't want people to be lonely. 977.47s - 979.47s | We are social animals. 979.47s - 983.47s | We also get worse at reading and understanding our attention span 983.47s - 985.47s | due to the overload. 985.47s - 988.47s | And I can see that with my students. 988.47s - 993.33s | We are less able to communicate with other people 993.33s - 997.33s | because we have an escape route for social interaction. 997.33s - 999.33s | Social interaction is hard. 999.33s - 1001.33s | There is a lot of friction. 1001.33s - 1004.33s | But if you can go and look at cat videos on TikTok or YouTube, 1004.33s - 1006.33s | that is easy. 1006.33s - 1007.33s | That is frictionless. 1007.33s - 1009.33s | And that is why we will often go there. 1009.33s - 1013.33s | But that means also that we will not train our capabilities 1013.33s - 1015.33s | of engaging with other people. 1015.33s - 1019.33s | And that, of course, has consequences for democracy. 1019.33s - 1023.33s | Because if we are not active in markets and democracy, 1023.33s - 1027.33s | you know, it's going to hurt ourselves eventually. 1027.33s - 1031.12s | So data-driven business models, 1031.12s - 1033.12s | including those that use artificial intelligence, 1033.12s - 1035.12s | whatever that means, 1035.12s - 1037.12s | that


chunk_text:
- 985.47s | due to the overload. 985.47s - 988.47s | And I can see that with my students. 988.47s - 993.33s | We are less able to communicate with other people 993.33s - 997.33s | because we have an escape route for social interaction. 997.33s - 999.33s | Social interaction is hard. 999.33s - 1001.33s | There is a lot of friction. 1001.33s - 1004.33s | But if you can go and look at cat videos on TikTok or YouTube, 1004.33s - 1006.33s | that is easy. 1006.33s - 1007.33s | That is frictionless. 1007.33s - 1009.33s | And that is why we will often go there. 1009.33s - 1013.33s | But that means also that we will not train our capabilities 1013.33s - 1015.33s | of engaging with other people. 1015.33s - 1019.33s | And that, of course, has consequences for democracy. 1019.33s - 1023.33s | Because if we are not active in markets and democracy, 1023.33s - 1027.33s | you know, it's going to hurt ourselves eventually. 1027.33s - 1031.12s | So data-driven business models, 1031.12s - 1033.12s | including those that use artificial intelligence, 1033.12s - 1035.12s | whatever that means, 1035.12s - 1037.12s | that affects markets. 1037.12s - 1040.12s | Our ability to choose between different products. 1040.12s - 1045.12s | New natural monopoly due to network effects and so on. 1045.12s - 1048.12s | It also affects democracy, as I mentioned. 1048.12s - 1052.12s | And more important nowadays, geopolitics. 1052.12s - 1054.12s | We have a huge debate about TikTok. 1054.12s - 1057.12s | Can we use TikTok because they're based in China? 1057.12s - 1062.12s | And in my view, the problem with TikTok or similar providers 1062.12s - 1065.12s | are not so much that they are looking into our data, 1065.12s - 1067.12s | but the fact that they are actually making 1067.12s - 1069.12s | all our children look at cat videos 1069.12s - 1073.12s | instead of training their social engagement with each other. 1073.12s - 1077.12s | I think that is the big overlooked danger in all this. 1077.12s - 1080.12s | And then, of course, climate. 1080.12s - 1082.12s | I mean, first of all, we need to understand 1082.12s - 1084.12s | and realize the consequences of what we've been doing 1084.12s - 1086.12s | for the last 100, 150 years. 1086.12s - 1088.12s


chunk_text:
affects markets. 1037.12s - 1040.12s | Our ability to choose between different products. 1040.12s - 1045.12s | New natural monopoly due to network effects and so on. 1045.12s - 1048.12s | It also affects democracy, as I mentioned. 1048.12s - 1052.12s | And more important nowadays, geopolitics. 1052.12s - 1054.12s | We have a huge debate about TikTok. 1054.12s - 1057.12s | Can we use TikTok because they're based in China? 1057.12s - 1062.12s | And in my view, the problem with TikTok or similar providers 1062.12s - 1065.12s | are not so much that they are looking into our data, 1065.12s - 1067.12s | but the fact that they are actually making 1067.12s - 1069.12s | all our children look at cat videos 1069.12s - 1073.12s | instead of training their social engagement with each other. 1073.12s - 1077.12s | I think that is the big overlooked danger in all this. 1077.12s - 1080.12s | And then, of course, climate. 1080.12s - 1082.12s | I mean, first of all, we need to understand 1082.12s - 1084.12s | and realize the consequences of what we've been doing 1084.12s - 1086.12s | for the last 100, 150 years. 1086.12s - 1088.12s | What's going on there? 1088.12s - 1091.12s | That means that we can think critically. 1091.12s - 1094.12s | And if you can't think critically, we can just accept things. 1094.12s - 1097.12s | Oh, you know, everything is fine. 1097.12s - 1099.12s | But we also should realize, 1099.12s - 1101.12s | especially when it comes to generative AI, 1101.12s - 1105.12s | that the fact that we are talking about a bubble 1105.12s - 1107.12s | when it comes to generative AI 1107.12s - 1109.12s | is because they are running out of content 1109.12s - 1111.12s | to train their models on. 1111.12s - 1116.12s | But also the power grid doesn't have the proportions 1116.12s - 1119.12s | to feed all the energy that is used for it. 1119.12s - 1121.12s | And it's not going to happen in the next few years. 1121.12s - 1123.12s | So should we have a discussion 1123.12s - 1126.12s | about what our energy should be used for? 1126.12s - 1128.12s | Or should we just have a market saying, 1128.12s - 1130.12s | those that pay the most? 1130.12s - 1133.12s | And I could imagine that


chunk_text:
| What's going on there? 1088.12s - 1091.12s | That means that we can think critically. 1091.12s - 1094.12s | And if you can't think critically, we can just accept things. 1094.12s - 1097.12s | Oh, you know, everything is fine. 1097.12s - 1099.12s | But we also should realize, 1099.12s - 1101.12s | especially when it comes to generative AI, 1101.12s - 1105.12s | that the fact that we are talking about a bubble 1105.12s - 1107.12s | when it comes to generative AI 1107.12s - 1109.12s | is because they are running out of content 1109.12s - 1111.12s | to train their models on. 1111.12s - 1116.12s | But also the power grid doesn't have the proportions 1116.12s - 1119.12s | to feed all the energy that is used for it. 1119.12s - 1121.12s | And it's not going to happen in the next few years. 1121.12s - 1123.12s | So should we have a discussion 1123.12s - 1126.12s | about what our energy should be used for? 1126.12s - 1128.12s | Or should we just have a market saying, 1128.12s - 1130.12s | those that pay the most? 1130.12s - 1133.12s | And I could imagine that is maybe on the West Coast somewhere 1133.12s - 1136.12s | that they will have the most money to buy all the energy. 1136.12s - 1138.12s | But how will that affect the rest of us? 1138.12s - 1140.12s | Again, think about externality. 1140.12s - 1142.12s | Who's going to clean up this thing? 1142.12s - 1144.12s | And there we should also be aware 1144.12s - 1146.12s | when we talk about climate, 1147.12s - 1150.12s | there are people in other places 1150.12s - 1155.12s | that will feel the harms more than we will, maybe. 1155.12s - 1158.12s | But it's also our children 1158.12s - 1160.12s | that will have to pay the price and their children. 1160.12s - 1162.12s | We should also be aware of that. 1162.12s - 1165.12s | That is part of rational choice 1165.12s - 1167.12s | that is thinking about future generations, 1167.12s - 1169.12s | which is very complicated. 1169.12s - 1171.12s | And that is why it's much easier to just buy 1171.12s - 1174.12s | what we think we need or feel what we need 1174.12s - 1177.12s | and just rationalize it afterwards. 1177.12s -


chunk_text:
is maybe on the West Coast somewhere 1133.12s - 1136.12s | that they will have the most money to buy all the energy. 1136.12s - 1138.12s | But how will that affect the rest of us? 1138.12s - 1140.12s | Again, think about externality. 1140.12s - 1142.12s | Who's going to clean up this thing? 1142.12s - 1144.12s | And there we should also be aware 1144.12s - 1146.12s | when we talk about climate, 1147.12s - 1150.12s | there are people in other places 1150.12s - 1155.12s | that will feel the harms more than we will, maybe. 1155.12s - 1158.12s | But it's also our children 1158.12s - 1160.12s | that will have to pay the price and their children. 1160.12s - 1162.12s | We should also be aware of that. 1162.12s - 1165.12s | That is part of rational choice 1165.12s - 1167.12s | that is thinking about future generations, 1167.12s - 1169.12s | which is very complicated. 1169.12s - 1171.12s | And that is why it's much easier to just buy 1171.12s - 1174.12s | what we think we need or feel what we need 1174.12s - 1177.12s | and just rationalize it afterwards. 1177.12s - 1181.50s | The whole idea of data-driven business models 1181.50s - 1184.50s | is that you're basically, as such a company, 1184.50s - 1188.50s | you're looking at humans as programmable objects. 1188.50s - 1191.50s | So that is how we are seen. 1191.50s - 1193.50s | You know, Mark Zuckerberg, Elon Musk and so on 1193.50s - 1195.50s | don't care about their users. 1195.50s - 1197.50s | They care about money, 1197.50s - 1199.50s | which is completely legitimate in a market economy, 1199.50s - 1201.50s | profit maximization. 1201.50s - 1203.50s | They don't care about you. 1203.50s - 1205.50s | So they will do whatever they can 1205.50s - 1207.50s | as long as it's profitable, 1207.50s - 1209.50s | including manipulate you to buy stuff 1209.50s - 1211.50s | to stay longer on their platform 1211.50s - 1214.50s | so they can sell more advertising and so on. 1214.50s - 1217.50s | So you could make the argument 1217.50s - 1220.50s | that by using technology the way we do, 1220.50s - 1223.50s | we have been domesticated by technology. 1223.50s - 1228.50s | We talk about augmented reality 1228.50s - 1231.50s | and we


chunk_text:
1181.50s | The whole idea of data-driven business models 1181.50s - 1184.50s | is that you're basically, as such a company, 1184.50s - 1188.50s | you're looking at humans as programmable objects. 1188.50s - 1191.50s | So that is how we are seen. 1191.50s - 1193.50s | You know, Mark Zuckerberg, Elon Musk and so on 1193.50s - 1195.50s | don't care about their users. 1195.50s - 1197.50s | They care about money, 1197.50s - 1199.50s | which is completely legitimate in a market economy, 1199.50s - 1201.50s | profit maximization. 1201.50s - 1203.50s | They don't care about you. 1203.50s - 1205.50s | So they will do whatever they can 1205.50s - 1207.50s | as long as it's profitable, 1207.50s - 1209.50s | including manipulate you to buy stuff 1209.50s - 1211.50s | to stay longer on their platform 1211.50s - 1214.50s | so they can sell more advertising and so on. 1214.50s - 1217.50s | So you could make the argument 1217.50s - 1220.50s | that by using technology the way we do, 1220.50s - 1223.50s | we have been domesticated by technology. 1223.50s - 1228.50s | We talk about augmented reality 1228.50s - 1231.50s | and we talk about virtual realities, 1231.50s - 1234.50s | but I think we should talk about abated realities. 1234.50s - 1237.50s | So our real reality is being abated 1237.50s - 1239.50s | by using technology. 1239.50s - 1242.50s | And just to quote Postman once again, 1242.50s - 1246.50s | to be against technology is like being against food. 1246.50s - 1248.50s | It doesn't make sense. 1248.50s - 1251.50s | So I'm not saying you shouldn't use technology. 1251.50s - 1253.50s | I'm just arguing that we should be more conscious 1253.50s - 1255.50s | about how we use it, 1255.50s - 1258.50s | recognizing how it's being used against us. 1258.50s - 1262.50s | So when I say we are not paying with personal data, 1262.50s - 1264.50s | which we are, we are paying with personal data, 1264.50s - 1267.50s | but we are also paying with attention. 1267.50s - 1270.50s | We are paying with our agency, 1270.50s - 1272.50s | our ability to make rational choices. 1272.50s - 1277.50s | And attention and agency are scarce resources. 1277.50s - 1279.50s | So when we talk about personal data, 1279.50s - 1281.50s | you can take


chunk_text:
talk about virtual realities, 1231.50s - 1234.50s | but I think we should talk about abated realities. 1234.50s - 1237.50s | So our real reality is being abated 1237.50s - 1239.50s | by using technology. 1239.50s - 1242.50s | And just to quote Postman once again, 1242.50s - 1246.50s | to be against technology is like being against food. 1246.50s - 1248.50s | It doesn't make sense. 1248.50s - 1251.50s | So I'm not saying you shouldn't use technology. 1251.50s - 1253.50s | I'm just arguing that we should be more conscious 1253.50s - 1255.50s | about how we use it, 1255.50s - 1258.50s | recognizing how it's being used against us. 1258.50s - 1262.50s | So when I say we are not paying with personal data, 1262.50s - 1264.50s | which we are, we are paying with personal data, 1264.50s - 1267.50s | but we are also paying with attention. 1267.50s - 1270.50s | We are paying with our agency, 1270.50s - 1272.50s | our ability to make rational choices. 1272.50s - 1277.50s | And attention and agency are scarce resources. 1277.50s - 1279.50s | So when we talk about personal data, 1279.50s - 1281.50s | you can take the same personal data 1281.50s - 1282.50s | and get a lot of stuff for free. 1282.50s - 1284.50s | I'm the clever guy, right? 1284.50s - 1286.50s | I get all these things for free 1286.50s - 1288.50s | and I use the same data. 1288.50s - 1290.50s | But again, you should be curious 1290.50s - 1292.50s | about what the data is being used for. 1292.50s - 1296.50s | And if it's being used to make us addicted to technologies, 1296.50s - 1298.50s | we are paying with attention. 1298.50s - 1299.50s | When we are being manipulated, 1299.50s - 1301.50s | we are paying with agency, 1301.50s - 1305.50s | the scarce resources that we need to lead good lives. 1305.50s - 1309.06s | So the solution I come up with is 1309.06s - 1311.06s | that we should focus more on human dignity. 1311.06s - 1316.06s | So we should design policy, business, and so on 1316.06s - 1318.06s | based on human dignity. 1318.06s - 1320.06s | Because human dignity is basically the idea 1320.06s - 1326.06s | of not reducing the individual to an object. 1326.06s - 1328.06s | And that's exactly what's


chunk_text:
the same personal data 1281.50s - 1282.50s | and get a lot of stuff for free. 1282.50s - 1284.50s | I'm the clever guy, right? 1284.50s - 1286.50s | I get all these things for free 1286.50s - 1288.50s | and I use the same data. 1288.50s - 1290.50s | But again, you should be curious 1290.50s - 1292.50s | about what the data is being used for. 1292.50s - 1296.50s | And if it's being used to make us addicted to technologies, 1296.50s - 1298.50s | we are paying with attention. 1298.50s - 1299.50s | When we are being manipulated, 1299.50s - 1301.50s | we are paying with agency, 1301.50s - 1305.50s | the scarce resources that we need to lead good lives. 1305.50s - 1309.06s | So the solution I come up with is 1309.06s - 1311.06s | that we should focus more on human dignity. 1311.06s - 1316.06s | So we should design policy, business, and so on 1316.06s - 1318.06s | based on human dignity. 1318.06s - 1320.06s | Because human dignity is basically the idea 1320.06s - 1326.06s | of not reducing the individual to an object. 1326.06s - 1328.06s | And that's exactly what's going on here. 1328.06s - 1330.06s | So what is human dignity? 1330.06s - 1332.06s | Well, human dignity has a history 1332.06s - 1335.06s | in philosophy and religion and so on. 1335.06s - 1340.06s | But with the declaration of the fundamental rights 1340.06s - 1342.06s | from the United Nations, 1342.06s - 1344.06s | it was actually put into a law. 1344.06s - 1346.06s | It's a legal value now. 1346.06s - 1349.06s | And I suggest in my book that we see 1349.06s - 1351.06s | in a liberal democracy, 1351.06s - 1355.06s | we see our constitutions on fundamental human rights. 1355.06s - 1359.06s | We see that as the operating system of our society. 1359.06s - 1361.06s | And the reason why I use the metaphor 1361.06s - 1363.06s | of an operating system 1363.06s - 1365.06s | is because it's not a given. 1365.06s - 1366.06s | You know better than I do 1366.06s - 1369.06s | how you can change the operating system of a computer. 1369.06s - 1373.06s | Just like we can change the operating system of a society. 1374.06s - 1376.06s | Which some people would like. 1376.06s -


chunk_text:
going on here. 1328.06s - 1330.06s | So what is human dignity? 1330.06s - 1332.06s | Well, human dignity has a history 1332.06s - 1335.06s | in philosophy and religion and so on. 1335.06s - 1340.06s | But with the declaration of the fundamental rights 1340.06s - 1342.06s | from the United Nations, 1342.06s - 1344.06s | it was actually put into a law. 1344.06s - 1346.06s | It's a legal value now. 1346.06s - 1349.06s | And I suggest in my book that we see 1349.06s - 1351.06s | in a liberal democracy, 1351.06s - 1355.06s | we see our constitutions on fundamental human rights. 1355.06s - 1359.06s | We see that as the operating system of our society. 1359.06s - 1361.06s | And the reason why I use the metaphor 1361.06s - 1363.06s | of an operating system 1363.06s - 1365.06s | is because it's not a given. 1365.06s - 1366.06s | You know better than I do 1366.06s - 1369.06s | how you can change the operating system of a computer. 1369.06s - 1373.06s | Just like we can change the operating system of a society. 1374.06s - 1376.06s | Which some people would like. 1376.06s - 1382.44s | When we see fundamental rights constitutions 1382.44s - 1384.44s | as the operating system, 1384.44s - 1387.44s | we can see secondary law legislation 1387.44s - 1389.44s | as the application layer. 1389.44s - 1391.44s | That means that we should understand everything 1391.44s - 1392.44s | on the application layer 1392.44s - 1397.44s | in light of the operating system of human dignity. 1397.44s - 1400.44s | So we should design everything for human dignity 1400.44s - 1402.44s | and have that in the back of our mind. 1402.44s - 1404.44s | So what is human dignity? 1404.44s - 1408.44s | So in the book I work with freedom. 1408.44s - 1412.44s | So the idea that we should be free individuals having agency. 1412.44s - 1414.44s | We should have not only the right 1414.44s - 1417.44s | but also the ability to think critically. 1417.44s - 1420.44s | We should make sure that 1420.44s - 1422.44s | those people providing the software 1422.44s - 1424.44s | or tools, apps to us, 1424.44s - 1426.44s | that to some extent 1426.44s - 1430.44s | that they align their products with our goals. 1431.44s - 1434.23s |


chunk_text:
1382.44s | When we see fundamental rights constitutions 1382.44s - 1384.44s | as the operating system, 1384.44s - 1387.44s | we can see secondary law legislation 1387.44s - 1389.44s | as the application layer. 1389.44s - 1391.44s | That means that we should understand everything 1391.44s - 1392.44s | on the application layer 1392.44s - 1397.44s | in light of the operating system of human dignity. 1397.44s - 1400.44s | So we should design everything for human dignity 1400.44s - 1402.44s | and have that in the back of our mind. 1402.44s - 1404.44s | So what is human dignity? 1404.44s - 1408.44s | So in the book I work with freedom. 1408.44s - 1412.44s | So the idea that we should be free individuals having agency. 1412.44s - 1414.44s | We should have not only the right 1414.44s - 1417.44s | but also the ability to think critically. 1417.44s - 1420.44s | We should make sure that 1420.44s - 1422.44s | those people providing the software 1422.44s - 1424.44s | or tools, apps to us, 1424.44s - 1426.44s | that to some extent 1426.44s - 1430.44s | that they align their products with our goals. 1431.44s - 1434.23s | We should also make sure that 1434.23s - 1436.23s | if you're using for instance AI 1436.23s - 1438.23s | that should be voluntary. 1438.23s - 1442.23s | Just think about when we got My AI in Snapchat. 1442.23s - 1444.23s | Well that was to children. 1444.23s - 1447.23s | Here, dear children, here is a chatbot. 1447.23s - 1449.23s | That means that you can spend more time 1449.23s - 1451.23s | and give us more data by using that. 1451.23s - 1453.23s | Think about the incentives. 1453.23s - 1456.23s | We should think about privacy. 1456.23s - 1459.23s | Personal data and security. 1460.23s - 1462.23s | And I would say one of the most successful 1462.23s - 1464.23s | pieces of legislation from the EU 1464.23s - 1466.23s | must be the GDPR. 1466.23s - 1468.23s | And I hope you will get something akin to that 1468.23s - 1470.23s | here in the US as well. 1470.23s - 1473.23s | But just remember that we have 1473.23s - 1476.23s | the UN principles on human rights as well 1476.23s - 1478.23s | that protects privacy. 1478.23s - 1480.23s | One thing I would emphasize


chunk_text:
We should also make sure that 1434.23s - 1436.23s | if you're using for instance AI 1436.23s - 1438.23s | that should be voluntary. 1438.23s - 1442.23s | Just think about when we got My AI in Snapchat. 1442.23s - 1444.23s | Well that was to children. 1444.23s - 1447.23s | Here, dear children, here is a chatbot. 1447.23s - 1449.23s | That means that you can spend more time 1449.23s - 1451.23s | and give us more data by using that. 1451.23s - 1453.23s | Think about the incentives. 1453.23s - 1456.23s | We should think about privacy. 1456.23s - 1459.23s | Personal data and security. 1460.23s - 1462.23s | And I would say one of the most successful 1462.23s - 1464.23s | pieces of legislation from the EU 1464.23s - 1466.23s | must be the GDPR. 1466.23s - 1468.23s | And I hope you will get something akin to that 1468.23s - 1470.23s | here in the US as well. 1470.23s - 1473.23s | But just remember that we have 1473.23s - 1476.23s | the UN principles on human rights as well 1476.23s - 1478.23s | that protects privacy. 1478.23s - 1480.23s | One thing I would emphasize here 1480.23s - 1482.23s | when we talk about privacy and personal data 1482.23s - 1484.23s | because that's basically two different things. 1484.23s - 1487.23s | So personal data is information about 1487.23s - 1488.23s | each individual. 1488.23s - 1490.23s | That's about individuals. 1490.23s - 1492.23s | And what we see when we are looking at 1492.23s - 1494.23s | artificial intelligence, 1494.23s - 1496.23s | especially generative AI, 1496.23s - 1499.23s | you're building large language models 1499.23s - 1501.23s | based on personal data. 1501.23s - 1504.23s | But when you create the large language model 1504.23s - 1507.23s | suddenly you're not dealing with personal data. 1507.23s - 1510.23s | But does that mean that you can just do that? 1510.23s - 1512.23s | And I don't think we can do that. 1512.23s - 1515.23s | Because if I have a big model 1515.23s - 1518.23s | of how consumers, how citizens 1518.23s - 1523.23s | are reacting to certain things, 1523.23s - 1526.23s | how you have correlations between certain things, 1526.23s - 1530.23s | you can actually use that to invade people's privacy. 1530.23s - 1532.23s | And that is why I


chunk_text:
here 1480.23s - 1482.23s | when we talk about privacy and personal data 1482.23s - 1484.23s | because that's basically two different things. 1484.23s - 1487.23s | So personal data is information about 1487.23s - 1488.23s | each individual. 1488.23s - 1490.23s | That's about individuals. 1490.23s - 1492.23s | And what we see when we are looking at 1492.23s - 1494.23s | artificial intelligence, 1494.23s - 1496.23s | especially generative AI, 1496.23s - 1499.23s | you're building large language models 1499.23s - 1501.23s | based on personal data. 1501.23s - 1504.23s | But when you create the large language model 1504.23s - 1507.23s | suddenly you're not dealing with personal data. 1507.23s - 1510.23s | But does that mean that you can just do that? 1510.23s - 1512.23s | And I don't think we can do that. 1512.23s - 1515.23s | Because if I have a big model 1515.23s - 1518.23s | of how consumers, how citizens 1518.23s - 1523.23s | are reacting to certain things, 1523.23s - 1526.23s | how you have correlations between certain things, 1526.23s - 1530.23s | you can actually use that to invade people's privacy. 1530.23s - 1532.23s | And that is why I think in the future, 1532.23s - 1533.23s | in the near future, 1533.23s - 1536.23s | we will talk less about personal data 1536.23s - 1539.23s | and much more about privacy in general. 1539.23s - 1541.23s | And just to illustrate this, 1541.23s - 1543.23s | we have five or six court cases 1543.23s - 1547.23s | from the Court of Justice of the European Union 1547.23s - 1549.23s | dealing with data retention. 1549.23s - 1552.23s | So in essence, they were about 1552.23s - 1555.23s | police for fighting serious crime 1555.23s - 1558.23s | wanting to get access to metadata 1558.23s - 1561.23s | from the telecom operators. 1561.23s - 1563.23s | And what the Court of Justice said, 1563.23s - 1565.23s | that is too far-reaching. 1565.23s - 1567.23s | That is too much of an interference 1567.23s - 1569.23s | with people's privacy 1569.23s - 1572.23s | that the police would get access to metadata 1572.23s - 1576.23s | to have indiscriminate access to all the metadata. 1576.23s - 1579.23s | And the question that is obvious to raise here is, 1579.23s - 1583.23s | do we think that social media services, big tech,


chunk_text:
think in the future, 1532.23s - 1533.23s | in the near future, 1533.23s - 1536.23s | we will talk less about personal data 1536.23s - 1539.23s | and much more about privacy in general. 1539.23s - 1541.23s | And just to illustrate this, 1541.23s - 1543.23s | we have five or six court cases 1543.23s - 1547.23s | from the Court of Justice of the European Union 1547.23s - 1549.23s | dealing with data retention. 1549.23s - 1552.23s | So in essence, they were about 1552.23s - 1555.23s | police for fighting serious crime 1555.23s - 1558.23s | wanting to get access to metadata 1558.23s - 1561.23s | from the telecom operators. 1561.23s - 1563.23s | And what the Court of Justice said, 1563.23s - 1565.23s | that is too far-reaching. 1565.23s - 1567.23s | That is too much of an interference 1567.23s - 1569.23s | with people's privacy 1569.23s - 1572.23s | that the police would get access to metadata 1572.23s - 1576.23s | to have indiscriminate access to all the metadata. 1576.23s - 1579.23s | And the question that is obvious to raise here is, 1579.23s - 1583.23s | do we think that social media services, big tech, 1583.23s - 1586.23s | do they have more or less personal data 1586.23s - 1588.23s | or data in general about us 1588.23s - 1591.23s | than telecom operators? 1591.23s - 1595.96s | Probably with some magnitude more data. 1595.96s - 1597.96s | The next question we should ask ourselves. 1597.96s - 1600.96s | So fighting serious crime, 1600.96s - 1604.96s | is that more important than serving personalized marketing? 1604.96s - 1607.96s | And again, the answer should be obvious. 1607.96s - 1610.96s | And that is also one of the reasons why it should be obvious 1610.96s - 1614.96s | that the current models, under EU law at least, 1614.96s - 1616.96s | are not viable, they are not legal. 1616.96s - 1618.96s | That will be my argument. 1618.96s - 1621.96s | But just the fact here that I think we should 1621.96s - 1624.96s | still be curious about personal data, 1624.96s - 1626.96s | but I think the general concept of privacy 1626.96s - 1628.96s | will be much more important. 1628.96s - 1631.96s | Then of course there is equality, nondiscrimination, 1631.96s - 1633.96s | which is also part of human rights. 1633.96s -


chunk_text:
1583.23s - 1586.23s | do they have more or less personal data 1586.23s - 1588.23s | or data in general about us 1588.23s - 1591.23s | than telecom operators? 1591.23s - 1595.96s | Probably with some magnitude more data. 1595.96s - 1597.96s | The next question we should ask ourselves. 1597.96s - 1600.96s | So fighting serious crime, 1600.96s - 1604.96s | is that more important than serving personalized marketing? 1604.96s - 1607.96s | And again, the answer should be obvious. 1607.96s - 1610.96s | And that is also one of the reasons why it should be obvious 1610.96s - 1614.96s | that the current models, under EU law at least, 1614.96s - 1616.96s | are not viable, they are not legal. 1616.96s - 1618.96s | That will be my argument. 1618.96s - 1621.96s | But just the fact here that I think we should 1621.96s - 1624.96s | still be curious about personal data, 1624.96s - 1626.96s | but I think the general concept of privacy 1626.96s - 1628.96s | will be much more important. 1628.96s - 1631.96s | Then of course there is equality, nondiscrimination, 1631.96s - 1633.96s | which is also part of human rights. 1633.96s - 1636.96s | And we know that digital vulnerabilities 1636.96s - 1639.96s | will come out of artificial intelligence. 1639.96s - 1642.96s | Some people will lose their jobs and some won't. 1642.96s - 1645.96s | And the whole idea of getting AI 1645.96s - 1647.96s | is try to be more efficient so we can get rid 1647.96s - 1649.96s | of people working for us. 1649.96s - 1652.96s | Meaning also that we will lose potential whistleblowers. 1652.96s - 1655.96s | Wouldn't it be great if we could just automate everything 1655.96s - 1657.96s | so we wouldn't have anybody to blow the whistle 1657.96s - 1659.96s | and say there's something going on here? 1659.96s - 1663.96s | We will never see an Edward Snowden or Francis Haugen again 1663.96s - 1666.96s | because everything is being automated. 1666.96s - 1669.96s | And the last thing that comes with generative AI, as I said, 1669.96s - 1672.96s | that is their hunger for getting more data 1672.96s - 1674.96s | to train their models on. 1674.96s - 1677.96s | And that is why they are looking into whatever content 1677.96s - 1681.96s | you posted on Facebook 10


chunk_text:
1636.96s | And we know that digital vulnerabilities 1636.96s - 1639.96s | will come out of artificial intelligence. 1639.96s - 1642.96s | Some people will lose their jobs and some won't. 1642.96s - 1645.96s | And the whole idea of getting AI 1645.96s - 1647.96s | is try to be more efficient so we can get rid 1647.96s - 1649.96s | of people working for us. 1649.96s - 1652.96s | Meaning also that we will lose potential whistleblowers. 1652.96s - 1655.96s | Wouldn't it be great if we could just automate everything 1655.96s - 1657.96s | so we wouldn't have anybody to blow the whistle 1657.96s - 1659.96s | and say there's something going on here? 1659.96s - 1663.96s | We will never see an Edward Snowden or Francis Haugen again 1663.96s - 1666.96s | because everything is being automated. 1666.96s - 1669.96s | And the last thing that comes with generative AI, as I said, 1669.96s - 1672.96s | that is their hunger for getting more data 1672.96s - 1674.96s | to train their models on. 1674.96s - 1677.96s | And that is why they are looking into whatever content 1677.96s - 1681.96s | you posted on Facebook 10 or 20 years ago, 1681.96s - 1683.96s | and suddenly they consider it to be their property 1683.96s - 1685.96s | and can just use it to train data. 1685.96s - 1688.96s | Just like Apple can train their algorithms 1688.96s - 1691.96s | on all the photos you put up there. 1691.96s - 1695.96s | So intellectual property rights are extraordinarily important. 1695.96s - 1699.96s | So what I will talk about here is big tech arrogance. 1699.96s - 1702.96s | So big tech arrogance, in my view, 1702.96s - 1706.96s | would constitute the fact that you have companies. 1706.96s - 1711.96s | They can be small or large, but mainly big tech. 1711.96s - 1713.96s | They will have an interest 1713.96s - 1718.96s | and they will design their technology not in our interest. 1718.96s - 1721.96s | On the contrary, against our best interests. 1721.96s - 1727.96s | So they will make products that are not aligned with our interests. 1727.96s - 1730.96s | Then they will use storytelling 1730.96s - 1734.96s | to convince us that they're doing it for us. 1734.96s - 1739.96s | And in addition, they're buying and gaslighting our politicians.


chunk_text:
or 20 years ago, 1681.96s - 1683.96s | and suddenly they consider it to be their property 1683.96s - 1685.96s | and can just use it to train data. 1685.96s - 1688.96s | Just like Apple can train their algorithms 1688.96s - 1691.96s | on all the photos you put up there. 1691.96s - 1695.96s | So intellectual property rights are extraordinarily important. 1695.96s - 1699.96s | So what I will talk about here is big tech arrogance. 1699.96s - 1702.96s | So big tech arrogance, in my view, 1702.96s - 1706.96s | would constitute the fact that you have companies. 1706.96s - 1711.96s | They can be small or large, but mainly big tech. 1711.96s - 1713.96s | They will have an interest 1713.96s - 1718.96s | and they will design their technology not in our interest. 1718.96s - 1721.96s | On the contrary, against our best interests. 1721.96s - 1727.96s | So they will make products that are not aligned with our interests. 1727.96s - 1730.96s | Then they will use storytelling 1730.96s - 1734.96s | to convince us that they're doing it for us. 1734.96s - 1739.96s | And in addition, they're buying and gaslighting our politicians. 1739.96s - 1742.96s | This is too complicated. Don't regulate. 1742.96s - 1744.96s | You don't want to be in the EU, right? 1744.96s - 1746.96s | It's too complicated. You're protecting all the users. 1746.96s - 1750.96s | Don't go down that route. We're going to lose a lot of money. 1750.96s - 1755.96s | And they do that to not be regulated, not to be taxed. 1755.96s - 1758.96s | That is what I would consider to be big tech arrogance. 1758.96s - 1764.36s | So what do we do about this? 1764.36s - 1768.36s | So, of course, we need to have legislation, laws. 1768.36s - 1772.36s | But we have realized how difficult it is to enforce law 1772.36s - 1776.36s | when we are up against actors that are so big 1776.36s - 1781.36s | and don't care about complying with the law. 1781.36s - 1784.36s | That is very difficult. We've seen that over and over again. 1784.36s - 1788.36s | So Meta in the European Union got a fine of half a billion euros. 1788.36s - 1791.36s | Roughly half a billion US dollars. 1791.36s - 1795.36s | That's a parking fine. That's


chunk_text:
1739.96s - 1742.96s | This is too complicated. Don't regulate. 1742.96s - 1744.96s | You don't want to be in the EU, right? 1744.96s - 1746.96s | It's too complicated. You're protecting all the users. 1746.96s - 1750.96s | Don't go down that route. We're going to lose a lot of money. 1750.96s - 1755.96s | And they do that to not be regulated, not to be taxed. 1755.96s - 1758.96s | That is what I would consider to be big tech arrogance. 1758.96s - 1764.36s | So what do we do about this? 1764.36s - 1768.36s | So, of course, we need to have legislation, laws. 1768.36s - 1772.36s | But we have realized how difficult it is to enforce law 1772.36s - 1776.36s | when we are up against actors that are so big 1776.36s - 1781.36s | and don't care about complying with the law. 1781.36s - 1784.36s | That is very difficult. We've seen that over and over again. 1784.36s - 1788.36s | So Meta in the European Union got a fine of half a billion euros. 1788.36s - 1791.36s | Roughly half a billion US dollars. 1791.36s - 1795.36s | That's a parking fine. That's a license fee for them. 1795.36s - 1800.36s | They have profits of 40 billion each year. 1800.36s - 1803.36s | And this was a fine for what they had done for six years. 1803.36s - 1806.36s | Or maybe seven. It's a license fee. 1806.36s - 1810.36s | It's not going to change anything. 1810.36s - 1815.36s | So what I will propose here is that we focus on businesses. 1815.36s - 1818.36s | So I come from a consumer law background. 1818.36s - 1821.36s | But can we learn something in businesses from consumer law? 1821.36s - 1824.36s | And here I will argue that businesses, 1824.36s - 1827.36s | they are just as vulnerable as consumers. 1827.36s - 1830.36s | Especially when it comes to AI and generative AI. 1830.36s - 1834.36s | It's been hyped so much that many companies 1834.36s - 1840.36s | will feel obliged to buy these licenses. 1840.36s - 1842.36s | For instance, for Copilot. 1842.36s - 1844.36s | Because their competitors are doing it. 1844.36s - 1848.36s | The press are not critical about how much they can be used for. 1848.36s - 1850.36s | What are the gains? 1850.36s -


chunk_text:
a license fee for them. 1795.36s - 1800.36s | They have profits of 40 billion each year. 1800.36s - 1803.36s | And this was a fine for what they had done for six years. 1803.36s - 1806.36s | Or maybe seven. It's a license fee. 1806.36s - 1810.36s | It's not going to change anything. 1810.36s - 1815.36s | So what I will propose here is that we focus on businesses. 1815.36s - 1818.36s | So I come from a consumer law background. 1818.36s - 1821.36s | But can we learn something in businesses from consumer law? 1821.36s - 1824.36s | And here I will argue that businesses, 1824.36s - 1827.36s | they are just as vulnerable as consumers. 1827.36s - 1830.36s | Especially when it comes to AI and generative AI. 1830.36s - 1834.36s | It's been hyped so much that many companies 1834.36s - 1840.36s | will feel obliged to buy these licenses. 1840.36s - 1842.36s | For instance, for Copilot. 1842.36s - 1844.36s | Because their competitors are doing it. 1844.36s - 1848.36s | The press are not critical about how much they can be used for. 1848.36s - 1850.36s | What are the gains? 1850.36s - 1852.36s | I mean, as a business, you should think about 1852.36s - 1855.36s | what are the benefits and what are the downsides. 1855.36s - 1857.36s | So businesses are vulnerable. 1857.36s - 1859.36s | It's just like outsourcing stuff. 1859.36s - 1864.36s | So when you use generative AI in your business, 1864.36s - 1867.36s | it's like outsourcing. 1867.36s - 1869.36s | And we've seen that. 1869.36s - 1872.36s | There was a time when it was good to outsource all your production. 1872.36s - 1876.36s | We could get cheap stuff we didn't need made somewhere else. 1876.36s - 1882.36s | And now we realize there are some geopolitical issues about outsourcing. 1883.36s - 1889.36s | So think about buying into the generative AI hype 1889.36s - 1892.36s | as using the fear of missing out. 1892.36s - 1896.36s | As we've used for social media, for human beings, 1896.36s - 1901.36s | it's now being used as FOMO for businesses. 1901.36s - 1905.36s | It is also being said that if you don't buy these licenses, 1905.36s - 1909.36s | all your employees will go and use the unsafe version 1909.36s - 1913.36s | that's


chunk_text:
1852.36s | I mean, as a business, you should think about 1852.36s - 1855.36s | what are the benefits and what are the downsides. 1855.36s - 1857.36s | So businesses are vulnerable. 1857.36s - 1859.36s | It's just like outsourcing stuff. 1859.36s - 1864.36s | So when you use generative AI in your business, 1864.36s - 1867.36s | it's like outsourcing. 1867.36s - 1869.36s | And we've seen that. 1869.36s - 1872.36s | There was a time when it was good to outsource all your production. 1872.36s - 1876.36s | We could get cheap stuff we didn't need made somewhere else. 1876.36s - 1882.36s | And now we realize there are some geopolitical issues about outsourcing. 1883.36s - 1889.36s | So think about buying into the generative AI hype 1889.36s - 1892.36s | as using the fear of missing out. 1892.36s - 1896.36s | As we've used for social media, for human beings, 1896.36s - 1901.36s | it's now being used as FOMO for businesses. 1901.36s - 1905.36s | It is also being said that if you don't buy these licenses, 1905.36s - 1909.36s | all your employees will go and use the unsafe version 1909.36s - 1913.36s | that's freely available on the Internet. 1913.36s - 1917.36s | Try and ask your boss whether they want to pay for World of Warcraft 1917.36s - 1919.36s | or some other game. 1919.36s - 1924.36s | Because if you don't buy it to us, we will use it. 1924.36s - 1928.36s | So that is the pressure that is being put on businesses. 1928.36s - 1931.36s | And we should just realize that there are risks 1931.36s - 1933.36s | and associated costs with outsourcing. 1933.36s - 1936.36s | It creates new dependencies. 1936.36s - 1940.36s | Would we like to be as dependent in our core business strategy 1940.36s - 1945.36s | as most companies are in using Microsoft Office? 1945.36s - 1948.36s | When is the last time your company considered 1948.36s - 1953.36s | which word processor to use for their employees? 1953.36s - 1956.36s | Would you be in the same situation when it comes to artificial intelligence, 1956.36s - 1958.36s | when you have fired people in the hope 1958.36s - 1961.36s | that the AI would make you more efficient? 1961.36s - 1963.36s | And it turns out that it's not more efficient. 1963.36s -


chunk_text:
freely available on the Internet. 1913.36s - 1917.36s | Try and ask your boss whether they want to pay for World of Warcraft 1917.36s - 1919.36s | or some other game. 1919.36s - 1924.36s | Because if you don't buy it to us, we will use it. 1924.36s - 1928.36s | So that is the pressure that is being put on businesses. 1928.36s - 1931.36s | And we should just realize that there are risks 1931.36s - 1933.36s | and associated costs with outsourcing. 1933.36s - 1936.36s | It creates new dependencies. 1936.36s - 1940.36s | Would we like to be as dependent in our core business strategy 1940.36s - 1945.36s | as most companies are in using Microsoft Office? 1945.36s - 1948.36s | When is the last time your company considered 1948.36s - 1953.36s | which word processor to use for their employees? 1953.36s - 1956.36s | Would you be in the same situation when it comes to artificial intelligence, 1956.36s - 1958.36s | when you have fired people in the hope 1958.36s - 1961.36s | that the AI would make you more efficient? 1961.36s - 1963.36s | And it turns out that it's not more efficient. 1963.36s - 1965.36s | It's actually more expensive. 1965.36s - 1968.36s | Because who is going to pay the $1 trillion 1968.36s - 1973.36s | that is supposed to be invested in a generative AI? 1973.36s - 1975.36s | You and I. And who has the money? 1975.36s - 1976.36s | The businesses. 1976.36s - 1980.36s | So I think we should think about what businesses can do. 1980.36s - 1984.36s | And we see that with the action taken by certain business 1984.36s - 1988.36s | withdrawing advertising from the Social Media X. 1988.36s - 1990.36s | That is what businesses can do. 1990.36s - 1992.36s | Because businesses are big spenders. 1992.36s - 1996.36s | They buy stuff in massive amounts. 1996.36s - 1999.36s | So businesses can do something. 1999.36s - 2002.36s | So one thing you could ask yourself is, 2002.36s - 2005.36s | is cloud as cheap as social media or free? 2005.36s - 2007.36s | Especially if you're in a situation 2007.36s - 2011.36s | where the cloud content is being used to train AI. 2011.36s - 2014.36s | And also don't believe everything you read on the internet. 2014.36s - 2018.36s | Think about the


chunk_text:
1965.36s | It's actually more expensive. 1965.36s - 1968.36s | Because who is going to pay the $1 trillion 1968.36s - 1973.36s | that is supposed to be invested in a generative AI? 1973.36s - 1975.36s | You and I. And who has the money? 1975.36s - 1976.36s | The businesses. 1976.36s - 1980.36s | So I think we should think about what businesses can do. 1980.36s - 1984.36s | And we see that with the action taken by certain business 1984.36s - 1988.36s | withdrawing advertising from the Social Media X. 1988.36s - 1990.36s | That is what businesses can do. 1990.36s - 1992.36s | Because businesses are big spenders. 1992.36s - 1996.36s | They buy stuff in massive amounts. 1996.36s - 1999.36s | So businesses can do something. 1999.36s - 2002.36s | So one thing you could ask yourself is, 2002.36s - 2005.36s | is cloud as cheap as social media or free? 2005.36s - 2007.36s | Especially if you're in a situation 2007.36s - 2011.36s | where the cloud content is being used to train AI. 2011.36s - 2014.36s | And also don't believe everything you read on the internet. 2014.36s - 2018.36s | Think about the incentives of all the consultants telling you 2018.36s - 2020.36s | that you will become so much more efficient 2020.36s - 2024.36s | if you adopt generative AI in your business. 2024.36s - 2028.36s | Goldman Sachs had a very critical report out recently 2028.36s - 2032.36s | saying that it probably overstated how much benefit 2032.36s - 2037.36s | there will be to businesses from adopting generative AI. 2037.36s - 2041.36s | So what we should do is we should sense the environment 2041.36s - 2043.36s | we live in and act upon it. 2043.36s - 2046.36s | That's a definition of agency. 2046.36s - 2047.36s | As we talked about in the beginning, 2047.36s - 2050.36s | which is a part of empowerment, 2050.36s - 2052.36s | we should understand what's going on. 2052.36s - 2055.36s | And I've tried to present that to you. 2055.36s - 2057.36s | How does it work? 2057.36s - 2060.36s | How are we being used by technology? 2060.36s - 2063.36s | And again, I'm not saying technology is good or bad, 2063.36s - 2066.36s | but the current data-driven business models, 2066.36s - 2069.36s | including those based on AI, 2069.36s


chunk_text:
incentives of all the consultants telling you 2018.36s - 2020.36s | that you will become so much more efficient 2020.36s - 2024.36s | if you adopt generative AI in your business. 2024.36s - 2028.36s | Goldman Sachs had a very critical report out recently 2028.36s - 2032.36s | saying that it probably overstated how much benefit 2032.36s - 2037.36s | there will be to businesses from adopting generative AI. 2037.36s - 2041.36s | So what we should do is we should sense the environment 2041.36s - 2043.36s | we live in and act upon it. 2043.36s - 2046.36s | That's a definition of agency. 2046.36s - 2047.36s | As we talked about in the beginning, 2047.36s - 2050.36s | which is a part of empowerment, 2050.36s - 2052.36s | we should understand what's going on. 2052.36s - 2055.36s | And I've tried to present that to you. 2055.36s - 2057.36s | How does it work? 2057.36s - 2060.36s | How are we being used by technology? 2060.36s - 2063.36s | And again, I'm not saying technology is good or bad, 2063.36s - 2066.36s | but the current data-driven business models, 2066.36s - 2069.36s | including those based on AI, 2069.36s - 2072.36s | are not necessarily in our best interest. 2072.36s - 2074.36s | And we should be curious about that. 2075.36s - 2078.36s | We should also use the human superpower. 2078.36s - 2080.36s | What we can do as human beings 2080.36s - 2085.36s | is that we can imagine things that don't exist. 2085.36s - 2087.36s | That is our superpower. 2087.36s - 2090.36s | We can imagine a building that is not built yet. 2090.36s - 2093.36s | We can imagine value out of nothing. 2093.36s - 2096.36s | We can create NFTs and suddenly they have value 2096.36s - 2097.36s | and suddenly they don't. 2097.36s - 2100.36s | But we can imagine stuff that doesn't exist. 2100.36s - 2106.36s | So how can we as individuals imagine a better future? 2106.36s - 2111.36s | How can we imagine the companies we're working for or with? 2111.36s - 2115.36s | How can we talk to the people making decisions there? 2115.36s - 2117.36s | Maybe it's not necessarily a good idea 2117.36s - 2121.36s | to have generative AI licenses for all our employees, 2121.36s - 2126.36s | especially not if data is being used


chunk_text:
- 2072.36s | are not necessarily in our best interest. 2072.36s - 2074.36s | And we should be curious about that. 2075.36s - 2078.36s | We should also use the human superpower. 2078.36s - 2080.36s | What we can do as human beings 2080.36s - 2085.36s | is that we can imagine things that don't exist. 2085.36s - 2087.36s | That is our superpower. 2087.36s - 2090.36s | We can imagine a building that is not built yet. 2090.36s - 2093.36s | We can imagine value out of nothing. 2093.36s - 2096.36s | We can create NFTs and suddenly they have value 2096.36s - 2097.36s | and suddenly they don't. 2097.36s - 2100.36s | But we can imagine stuff that doesn't exist. 2100.36s - 2106.36s | So how can we as individuals imagine a better future? 2106.36s - 2111.36s | How can we imagine the companies we're working for or with? 2111.36s - 2115.36s | How can we talk to the people making decisions there? 2115.36s - 2117.36s | Maybe it's not necessarily a good idea 2117.36s - 2121.36s | to have generative AI licenses for all our employees, 2121.36s - 2126.36s | especially not if data is being used to train these models. 2127.36s - 2131.36s | We should recognize that democracy is the people ruling. 2131.36s - 2134.36s | It's not big tech ruling. 2134.36s - 2139.36s | So I would encourage and argue that human dignity 2139.36s - 2142.36s | can be used for us as individuals 2142.36s - 2147.36s | as a guiding policy for how we should see these things. 2147.36s - 2149.36s | It can be used for businesses. 2149.36s - 2153.36s | Would we accept to buy into generative AI 2153.36s - 2157.36s | that has been built on other people's content, 2157.36s - 2160.36s | infringing their copyrights? 2160.36s - 2164.36s | And I also think we should be more careful about recognizing 2164.36s - 2167.36s | that we are actually still living in a liberal democracy 2167.36s - 2171.36s | and we have human rights and take them seriously 2171.36s - 2174.36s | and have that into tech policy. 2174.36s - 2180.36s | So I emphasize that policy is also what you think, say, and do. 2180.36s - 2184.36s | And the best thing we can do for big tech at this moment 2184.36s - 2189.36s | is to ensure that


chunk_text:
to train these models. 2127.36s - 2131.36s | We should recognize that democracy is the people ruling. 2131.36s - 2134.36s | It's not big tech ruling. 2134.36s - 2139.36s | So I would encourage and argue that human dignity 2139.36s - 2142.36s | can be used for us as individuals 2142.36s - 2147.36s | as a guiding policy for how we should see these things. 2147.36s - 2149.36s | It can be used for businesses. 2149.36s - 2153.36s | Would we accept to buy into generative AI 2153.36s - 2157.36s | that has been built on other people's content, 2157.36s - 2160.36s | infringing their copyrights? 2160.36s - 2164.36s | And I also think we should be more careful about recognizing 2164.36s - 2167.36s | that we are actually still living in a liberal democracy 2167.36s - 2171.36s | and we have human rights and take them seriously 2171.36s - 2174.36s | and have that into tech policy. 2174.36s - 2180.36s | So I emphasize that policy is also what you think, say, and do. 2180.36s - 2184.36s | And the best thing we can do for big tech at this moment 2184.36s - 2189.36s | is to ensure that our children will not be able to do anything 2189.36s - 2191.36s | without big tech. 2191.36s - 2195.36s | Wouldn't it be great if people can't read, they can't think, 2195.36s - 2198.36s | they can't talk, they can't write 2198.36s - 2201.36s | without being dependent on generative AI? 2201.36s - 2203.36s | Wouldn't that be great? 2203.36s - 2206.36s | Then at least we will have the dystopian fantasy 2206.36s - 2209.36s | that we see from California. 2209.36s - 2212.36s | So what I will end this talk on is basically just saying 2212.36s - 2214.36s | don't out-solve humanity. 2214.36s - 2216.36s | We have to do something about this. 2216.36s - 2221.36s | And if we don't do it as employees, as business owners, 2221.36s - 2225.36s | as government officials, whatever, as hackers, 2225.36s - 2228.36s | if we don't take these things serious, 2228.36s - 2232.36s | it's going to be even worse than it is already now. 2232.36s - 2234.36s | In the book I ask the question, 2234.36s - 2237.36s | do we really have 10 years? 2237.36s - 2239.36s | And that was three years ago. 2239.36s - 2243.36s


chunk_text:
our children will not be able to do anything 2189.36s - 2191.36s | without big tech. 2191.36s - 2195.36s | Wouldn't it be great if people can't read, they can't think, 2195.36s - 2198.36s | they can't talk, they can't write 2198.36s - 2201.36s | without being dependent on generative AI? 2201.36s - 2203.36s | Wouldn't that be great? 2203.36s - 2206.36s | Then at least we will have the dystopian fantasy 2206.36s - 2209.36s | that we see from California. 2209.36s - 2212.36s | So what I will end this talk on is basically just saying 2212.36s - 2214.36s | don't out-solve humanity. 2214.36s - 2216.36s | We have to do something about this. 2216.36s - 2221.36s | And if we don't do it as employees, as business owners, 2221.36s - 2225.36s | as government officials, whatever, as hackers, 2225.36s - 2228.36s | if we don't take these things serious, 2228.36s - 2232.36s | it's going to be even worse than it is already now. 2232.36s - 2234.36s | In the book I ask the question, 2234.36s - 2237.36s | do we really have 10 years? 2237.36s - 2239.36s | And that was three years ago. 2239.36s - 2243.36s | Do we have seven years to get the balance right? 2243.36s - 2246.36s | You make the decision, you can go and do a lot of stuff, 2246.36s - 2250.36s | talk to people, talk to your friends, talk to your family, 2250.36s - 2252.36s | just have discussions about these things, 2252.36s - 2254.36s | revealing what's really going on. 2254.36s - 2256.36s | Thank you so much for your attention.


chunk_text:
| Do we have seven years to get the balance right? 2243.36s - 2246.36s | You make the decision, you can go and do a lot of stuff, 2246.36s - 2250.36s | talk to people, talk to your friends, talk to your family, 2250.36s - 2252.36s | just have discussions about these things, 2252.36s - 2254.36s | revealing what's really going on. 2254.36s - 2256.36s | Thank you so much for your attention.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=8IzKwczq0jI", "title": "DEF CON 32 - Leveraging AI for Smarter Bug Bounties - Diego Jurado & Joel Niemand Sec Noguera", "description": "As security researchers, we constantly attempt to stay ahead of the curve, seeking innovative solutions to enhance our offensive security strategies. In recent years, the advent of artificial intelligence (AI) has introduced a new dimension to our efforts, particularly in the realm of bug bounties and pentesting. While significant attention has been given to understanding and mitigating attacks against AI systems, the potential of AI to assist in the offensive security field remains largely unclear.\n\nThis talk pretends to dig into the research and development process undertaken to create an AI agent designed to augment the bug bounty and pentesting workflow. Our AI agent is not merely a theoretical concept but a practical tool aimed at enhancing the efficiency and effectiveness of security researchers.\n\nWe have conducted extensive research to understand how AI can mimic and enhance human intuition and creativity in identifying vulnerabilities. While this may sound trivial, there is little evidence of this being tested before on generative AI agents. Our work breaks new ground by pushing the boundaries of what AI can achieve in offensive security.\n\nWill AI become an indispensable tool in our arsenal, capable of autonomously identifying and exploiting vulnerabilities? Join us as we explore the possibilities and implications of AI as an offensive assistant in this new era of offensive security.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2453, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.08s | This text was transcribed using whisper model: large-v2 So, welcome everyone to our talk, Leveraging AI for Smart Debug Bounties. 5.08s - 10.10s | First of all, thank you to DEF CON and the Bug Bounty Village for giving us this space 10.10s - 17.44s | to discuss how AIs can improve and change the security field and the bug bounty space. 17.44s - 22.60s | We are going to be discussing how AIs can improve our daily job and help us work on 22.60s - 28.10s | what we want and also let the AI take care of other stuff. 28.10s - 31.50s | So his name is Diego Jurado, I'm Joel Noguera. 31.50s - 34.40s | We are both security researchers at Expo. 34.40s - 40.98s | For those that don't know us, we have been quite a while in the bug bounty scene. 40.98s -


chunk_text:
AI become an indispensable tool in our arsenal, capable of autonomously identifying and exploiting vulnerabilities? Join us as we explore the possibilities and implications of AI as an offensive assistant in this new era of offensive security.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2453, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.08s | This text was transcribed using whisper model: large-v2 So, welcome everyone to our talk, Leveraging AI for Smart Debug Bounties. 5.08s - 10.10s | First of all, thank you to DEF CON and the Bug Bounty Village for giving us this space 10.10s - 17.44s | to discuss how AIs can improve and change the security field and the bug bounty space. 17.44s - 22.60s | We are going to be discussing how AIs can improve our daily job and help us work on 22.60s - 28.10s | what we want and also let the AI take care of other stuff. 28.10s - 31.50s | So his name is Diego Jurado, I'm Joel Noguera. 31.50s - 34.40s | We are both security researchers at Expo. 34.40s - 40.98s | For those that don't know us, we have been quite a while in the bug bounty scene. 40.98s - 47.78s | And apart from that, we have been also working for several years in some well-known companies 47.78s - 53.64s | in the security industry as security researchers and testers. 53.64s - 56.90s | So let's start from the very beginning. 56.90s - 63.06s | When we started this three months ago, we started looking that there may... 63.06s - 68.34s | In the recent years, we have seen a lot of research being published about people hacking 68.34s - 69.34s | AIs, right? 69.34s - 75.86s | Like people doing research about publishing how to force the AI to do unexpected things, 75.86s - 77.78s | to leak information, et cetera. 77.78s - 84.18s | However, there is one particular brand that remains unclear regarding AIs and is how AIs 84.18s - 86.78s | could be used in a more offensive way. 86.78s - 92.22s | In other words, would be the AI hacking for us and taking care of some stuff that we could 92.22s - 93.94s | do. 93.94s - 95.46s | And so we have been just... 95.46s - 100.46s | We started three months ago, and we don't know where the limit is for


chunk_text:
47.78s | And apart from that, we have been also working for several years in some well-known companies 47.78s - 53.64s | in the security industry as security researchers and testers. 53.64s - 56.90s | So let's start from the very beginning. 56.90s - 63.06s | When we started this three months ago, we started looking that there may... 63.06s - 68.34s | In the recent years, we have seen a lot of research being published about people hacking 68.34s - 69.34s | AIs, right? 69.34s - 75.86s | Like people doing research about publishing how to force the AI to do unexpected things, 75.86s - 77.78s | to leak information, et cetera. 77.78s - 84.18s | However, there is one particular brand that remains unclear regarding AIs and is how AIs 84.18s - 86.78s | could be used in a more offensive way. 86.78s - 92.22s | In other words, would be the AI hacking for us and taking care of some stuff that we could 92.22s - 93.94s | do. 93.94s - 95.46s | And so we have been just... 95.46s - 100.46s | We started three months ago, and we don't know where the limit is for this technology, 100.46s - 105.74s | but we wanted to show you one quick example of the things that an AI agent could do on 105.74s - 108.69s | our field. 108.69s - 113.17s | So first of all, we are going to be talking about different questions, interesting questions 113.17s - 119.17s | that we have been encounter while doing this journey. 119.17s - 123.77s | And this is one of the first one, and it's how can AIs mimic human bounty hunters? 123.77s - 129.05s | But in order to understand what a bounty hunter, what human bounty hunter means, we need to 129.05s - 131.13s | first understand what it is, right? 131.13s - 132.13s | For us. 132.13s - 137.89s | So humans have several skills and capabilities that we hardly seen on the tools that we use 137.89s - 139.65s | in our daily job. 139.65s - 145.61s | And some of them are intuition, creativity, and decision making based on the experience 145.61s - 147.37s | that we have collected before. 147.37s - 152.05s | For example, if we learn something doing bounties, this is something that we are going to apply 152.05s -


chunk_text:
this technology, 100.46s - 105.74s | but we wanted to show you one quick example of the things that an AI agent could do on 105.74s - 108.69s | our field. 108.69s - 113.17s | So first of all, we are going to be talking about different questions, interesting questions 113.17s - 119.17s | that we have been encounter while doing this journey. 119.17s - 123.77s | And this is one of the first one, and it's how can AIs mimic human bounty hunters? 123.77s - 129.05s | But in order to understand what a bounty hunter, what human bounty hunter means, we need to 129.05s - 131.13s | first understand what it is, right? 131.13s - 132.13s | For us. 132.13s - 137.89s | So humans have several skills and capabilities that we hardly seen on the tools that we use 137.89s - 139.65s | in our daily job. 139.65s - 145.61s | And some of them are intuition, creativity, and decision making based on the experience 145.61s - 147.37s | that we have collected before. 147.37s - 152.05s | For example, if we learn something doing bounties, this is something that we are going to apply 152.05s - 156.17s | in the future to keep improving and getting better results. 156.17s - 159.93s | So let's try to answer this question with the demo. 159.93s - 167.33s | In this case, we are going to see our agent exploiting a JWT Python implementation for 167.33s - 170.25s | this particular CVE. 170.25s - 175.45s | During the video, you are going to see the AI interacting with the web application, performing 175.45s - 181.61s | executing commands, processing the outputs, taking decisions, and creating goals and learning 181.61s - 184.77s | space on what it sees and learns during the process. 184.77s - 188.81s | All what it takes for this is just a small description or goal, and the target that we 188.81s - 194.28s | want to test. 194.28s - 198.96s | So I'm going to pause a little bit here, just to show you a little bit of the interface, 198.96s - 201.60s | because it's the first time you are seeing this. 201.60s - 208.24s | So on the first part, you're going to see what we give to the AI, just that we want 208.24s - 210.88s | to exploit that CVE and


chunk_text:
156.17s | in the future to keep improving and getting better results. 156.17s - 159.93s | So let's try to answer this question with the demo. 159.93s - 167.33s | In this case, we are going to see our agent exploiting a JWT Python implementation for 167.33s - 170.25s | this particular CVE. 170.25s - 175.45s | During the video, you are going to see the AI interacting with the web application, performing 175.45s - 181.61s | executing commands, processing the outputs, taking decisions, and creating goals and learning 181.61s - 184.77s | space on what it sees and learns during the process. 184.77s - 188.81s | All what it takes for this is just a small description or goal, and the target that we 188.81s - 194.28s | want to test. 194.28s - 198.96s | So I'm going to pause a little bit here, just to show you a little bit of the interface, 198.96s - 201.60s | because it's the first time you are seeing this. 201.60s - 208.24s | So on the first part, you're going to see what we give to the AI, just that we want 208.24s - 210.88s | to exploit that CVE and the target. 210.88s - 215.48s | Then you can see the things that the AI is processing, analyzing, and the decisions and 215.48s - 218.36s | learning that it's taking. 218.36s - 223.52s | Then you can see the commands and the output, and the goals that the AI is generating all 223.52s - 224.52s | by itself. 224.52s - 227.20s | We have no influence on that. 227.24s - 232.60s | So first of all, we start with the basic recon, and recognize that there is a register endpoint. 232.60s - 238.32s | So it decides to attempt to register a user, and in this case, it tries to use a content 238.32s - 242.36s | type JSON, which is grown and expected for the website. 242.36s - 246.60s | So it learns that based on the response, and decides to change that to use the correct 246.60s - 247.60s | content type. 247.60s - 254.04s | In this case, it registered a new user, and here on the bottom, you can see that the agent 254.04s - 259.32s | is logging in and saving the cookies on a cookie jar to use it later during the whole 259.32s


chunk_text:
the target. 210.88s - 215.48s | Then you can see the things that the AI is processing, analyzing, and the decisions and 215.48s - 218.36s | learning that it's taking. 218.36s - 223.52s | Then you can see the commands and the output, and the goals that the AI is generating all 223.52s - 224.52s | by itself. 224.52s - 227.20s | We have no influence on that. 227.24s - 232.60s | So first of all, we start with the basic recon, and recognize that there is a register endpoint. 232.60s - 238.32s | So it decides to attempt to register a user, and in this case, it tries to use a content 238.32s - 242.36s | type JSON, which is grown and expected for the website. 242.36s - 246.60s | So it learns that based on the response, and decides to change that to use the correct 246.60s - 247.60s | content type. 247.60s - 254.04s | In this case, it registered a new user, and here on the bottom, you can see that the agent 254.04s - 259.32s | is logging in and saving the cookies on a cookie jar to use it later during the whole 259.32s - 262.18s | thing. 262.18s - 267.58s | Once logged in, it detects on the response that it has a JWT token, so immediately binds 267.58s - 272.18s | this to the goal that we have provided, and decides to go to the internet to look for 272.18s - 275.14s | some public information and public exploits. 275.14s - 281.02s | Try NIST and GitHub, and in GitHub, it finds one match that is a possible proof of concept, 281.02s - 288.94s | so it decides to download the proof of concept, and you can see that it's going to cut the 288.94s - 289.94s | readme file. 289.94s - 291.22s | This is something that we always do, right? 291.22s - 296.50s | We want to understand how this exploit works, and we need to learn how to use it. 296.50s - 301.38s | So it's going to try to grab the token and run the exploit, but it makes a mistake. 301.38s - 302.90s | It's running in an incorrect path. 302.90s - 304.30s | Who hasn't been there, right? 304.30s - 306.98s | Like running an incorrect path for an exploit. 306.98s - 311.82s | So now


chunk_text:
- 262.18s | thing. 262.18s - 267.58s | Once logged in, it detects on the response that it has a JWT token, so immediately binds 267.58s - 272.18s | this to the goal that we have provided, and decides to go to the internet to look for 272.18s - 275.14s | some public information and public exploits. 275.14s - 281.02s | Try NIST and GitHub, and in GitHub, it finds one match that is a possible proof of concept, 281.02s - 288.94s | so it decides to download the proof of concept, and you can see that it's going to cut the 288.94s - 289.94s | readme file. 289.94s - 291.22s | This is something that we always do, right? 291.22s - 296.50s | We want to understand how this exploit works, and we need to learn how to use it. 296.50s - 301.38s | So it's going to try to grab the token and run the exploit, but it makes a mistake. 301.38s - 302.90s | It's running in an incorrect path. 302.90s - 304.30s | Who hasn't been there, right? 304.30s - 306.98s | Like running an incorrect path for an exploit. 306.98s - 311.82s | So now that it learns, we define where it is, it runs again everything, and it finds 311.82s - 316.22s | that there is one missing dependency, so it goes ahead and installs the dependency and 316.22s - 320.90s | runs again the exploit, changing the claim username to admin. 320.90s - 324.10s | This is a small detail that we are going to talk about later. 324.10s - 328.62s | Then it starts trying the different payloads that it's getting from the exploit against 328.62s - 333.46s | the whole application, changing from logging to registration to see where this exploit 333.46s - 334.46s | works or not. 334.94s - 341.14s | And at some point this works on the root page, so the AI realizes that it has been logged 341.14s - 350.06s | as the admin user and successfully retrieved the flag from the challenge that we have proposed. 350.06s - 361.22s | So during this video, we have seen some of the things that we mentioned before about 361.22s - 364.62s | humans and tools that we use every day. 364.62s - 369.62s | We have seen some creativity, learning from mistakes, like identifying the incorrect path 370.02s


chunk_text:
that it learns, we define where it is, it runs again everything, and it finds 311.82s - 316.22s | that there is one missing dependency, so it goes ahead and installs the dependency and 316.22s - 320.90s | runs again the exploit, changing the claim username to admin. 320.90s - 324.10s | This is a small detail that we are going to talk about later. 324.10s - 328.62s | Then it starts trying the different payloads that it's getting from the exploit against 328.62s - 333.46s | the whole application, changing from logging to registration to see where this exploit 333.46s - 334.46s | works or not. 334.94s - 341.14s | And at some point this works on the root page, so the AI realizes that it has been logged 341.14s - 350.06s | as the admin user and successfully retrieved the flag from the challenge that we have proposed. 350.06s - 361.22s | So during this video, we have seen some of the things that we mentioned before about 361.22s - 364.62s | humans and tools that we use every day. 364.62s - 369.62s | We have seen some creativity, learning from mistakes, like identifying the incorrect path 370.02s - 375.10s | and taking a decision to decide where to execute the exploit. 375.10s - 380.50s | But most important, we have seen the capability of the AI to adapt into different situations. 380.50s - 385.86s | We have seen the AI registering a user, changing the content type to adapt to what the application 385.86s - 392.78s | expects, using the credentials that just created, and then interacting with authenticating endpoints 392.78s - 395.86s | based on all the things that have learned. 395.86s - 400.62s | And something that really is interesting is, for example, things that we do, like cutting 400.62s - 405.30s | the readme for an exploit, reading the Python code to understand how it works. 405.30s - 409.34s | There are probably simple things for us, but when we talk about something that is going 409.34s - 414.34s | on all by itself and it's reading the code and understanding the input, the output, and 414.34s - 420.26s | also the claims that we need to modify from the JWT token, it's super interesting. 420.26s - 424.98s | And most interesting probably is that if you are familiar with DCVE, there is no


chunk_text:
- 375.10s | and taking a decision to decide where to execute the exploit. 375.10s - 380.50s | But most important, we have seen the capability of the AI to adapt into different situations. 380.50s - 385.86s | We have seen the AI registering a user, changing the content type to adapt to what the application 385.86s - 392.78s | expects, using the credentials that just created, and then interacting with authenticating endpoints 392.78s - 395.86s | based on all the things that have learned. 395.86s - 400.62s | And something that really is interesting is, for example, things that we do, like cutting 400.62s - 405.30s | the readme for an exploit, reading the Python code to understand how it works. 405.30s - 409.34s | There are probably simple things for us, but when we talk about something that is going 409.34s - 414.34s | on all by itself and it's reading the code and understanding the input, the output, and 414.34s - 420.26s | also the claims that we need to modify from the JWT token, it's super interesting. 420.26s - 424.98s | And most interesting probably is that if you are familiar with DCVE, there is no Nuclei 424.98s - 426.62s | template for this. 426.62s - 430.38s | And if you wonder why, it's probably because you first need a valid token, which would 430.38s - 435.26s | mean you have to register, sign in, and retrieve that token. 435.26s - 439.98s | Automatizing that for every existing application on the internet will be quite a challenge. 439.98s - 445.82s | In this case, the AI takes care of all that and makes progress on that goal. 445.82s - 450.62s | So in order to understand how we got here, we have to first understand where we were 450.62s - 453.74s | three months ago when we started. 453.74s - 460.86s | We started looking for different white papers that were trying to use agents in a more offensive 460.86s - 461.86s | way. 461.86s - 464.38s | We found a few of them, not many. 464.38s - 471.78s | But when we started looking at the results, and they all have different approaches. 471.78s - 476.86s | One super common was the human-in-the-loop, that is the human providing real-time feedback 476.86s - 479.34s | to the AI in order to improve the results. 479.34s -


chunk_text:
Nuclei 424.98s - 426.62s | template for this. 426.62s - 430.38s | And if you wonder why, it's probably because you first need a valid token, which would 430.38s - 435.26s | mean you have to register, sign in, and retrieve that token. 435.26s - 439.98s | Automatizing that for every existing application on the internet will be quite a challenge. 439.98s - 445.82s | In this case, the AI takes care of all that and makes progress on that goal. 445.82s - 450.62s | So in order to understand how we got here, we have to first understand where we were 450.62s - 453.74s | three months ago when we started. 453.74s - 460.86s | We started looking for different white papers that were trying to use agents in a more offensive 460.86s - 461.86s | way. 461.86s - 464.38s | We found a few of them, not many. 464.38s - 471.78s | But when we started looking at the results, and they all have different approaches. 471.78s - 476.86s | One super common was the human-in-the-loop, that is the human providing real-time feedback 476.86s - 479.34s | to the AI in order to improve the results. 479.34s - 483.82s | Other have full automated agents, like the one you are seeing, other have super specific 483.82s - 490.46s | agents where they were in charge of different tasks, and some of them were trying to exploit 490.46s - 496.11s | non-vulnerabilities or other type of CTF challenges. 496.11s - 500.15s | When we started looking at the results, for example, for this paper, actually one of the 500.15s - 505.87s | authors of this paper, Brendan Dolan-Gabit, is one of our colleagues at Expo. 505.87s - 510.75s | On this paper, they were trying to use LM agents to solve CTF challenges. 510.75s - 515.79s | If you see in the categories, they attempt to work with all of them, but probably if 515.79s - 520.63s | we pay attention to the web one, which is probably most interesting for us as bounty 520.63s - 523.95s | hunters, the results are not that promising, right? 523.95s - 526.75s | It's 16% just for one model. 526.75s - 534.87s | So we keep digging into the different papers, and we found another one that had more promising 534.87s - 535.87s | results. 535.87s - 541.63s | In this case,


chunk_text:
483.82s | Other have full automated agents, like the one you are seeing, other have super specific 483.82s - 490.46s | agents where they were in charge of different tasks, and some of them were trying to exploit 490.46s - 496.11s | non-vulnerabilities or other type of CTF challenges. 496.11s - 500.15s | When we started looking at the results, for example, for this paper, actually one of the 500.15s - 505.87s | authors of this paper, Brendan Dolan-Gabit, is one of our colleagues at Expo. 505.87s - 510.75s | On this paper, they were trying to use LM agents to solve CTF challenges. 510.75s - 515.79s | If you see in the categories, they attempt to work with all of them, but probably if 515.79s - 520.63s | we pay attention to the web one, which is probably most interesting for us as bounty 520.63s - 523.95s | hunters, the results are not that promising, right? 523.95s - 526.75s | It's 16% just for one model. 526.75s - 534.87s | So we keep digging into the different papers, and we found another one that had more promising 534.87s - 535.87s | results. 535.87s - 541.63s | In this case, they were trying to use LM agents to exploit one-day vulnerabilities. 541.63s - 546.75s | When we look there, we see an 87%, and that's quite exciting and promising, but when we 546.75s - 553.27s | start reading the results and the details, we see that if you remove the CV description 553.27s - 558.47s | that you provide to the model, that 87% drops dramatically to a 7%. 558.47s - 564.36s | So again, the results weren't that promising in this case. 564.36s - 569.40s | So as a conclusion from the state-of-the-art, the results weren't good at all for models 569.40s - 571.56s | at three months ago. 571.56s - 574.02s | All the cases weren't complex enough. 574.02s - 578.44s | For example, they were based on particular cases, like the exploit being just one, two 578.44s - 583.60s | lines, or just requiring two requests to successfully exploit it. 583.60s - 587.32s | And something that they have in common is that they were all limited. 587.32s - 592.92s | For example, this last paper only had 15 CVs on their paper, so when you try to scale this 593.00s - 598.44s | to the real


chunk_text:
they were trying to use LM agents to exploit one-day vulnerabilities. 541.63s - 546.75s | When we look there, we see an 87%, and that's quite exciting and promising, but when we 546.75s - 553.27s | start reading the results and the details, we see that if you remove the CV description 553.27s - 558.47s | that you provide to the model, that 87% drops dramatically to a 7%. 558.47s - 564.36s | So again, the results weren't that promising in this case. 564.36s - 569.40s | So as a conclusion from the state-of-the-art, the results weren't good at all for models 569.40s - 571.56s | at three months ago. 571.56s - 574.02s | All the cases weren't complex enough. 574.02s - 578.44s | For example, they were based on particular cases, like the exploit being just one, two 578.44s - 583.60s | lines, or just requiring two requests to successfully exploit it. 583.60s - 587.32s | And something that they have in common is that they were all limited. 587.32s - 592.92s | For example, this last paper only had 15 CVs on their paper, so when you try to scale this 593.00s - 598.44s | to the real world, you don't know how this is going to be expanded. 598.44s - 605.45s | So we wanted to change things and scale things up. 605.45s - 609.49s | So now let's talk about the approach that we had at Expo. 609.49s - 612.57s | As Joel was saying, we wanted to scale things up. 612.57s - 617.53s | So the first thing that we did was starting collecting thousands of benchmarks from different 617.53s - 620.65s | CTF competitions. 620.65s - 624.49s | We also partnered with some companies that you may know, like Postfigure and Pentester 624.49s - 625.49s | Labs. 625.49s - 631.01s | So they provided to us all the exercises that they have online, and we added to our benchmarks. 631.01s - 636.85s | Also we wanted to collect the most interesting and realistic challenges that we can find, 636.85s - 641.25s | and of course with a great focus in web applications. 641.25s - 645.71s | Also apart from that, we had to categorize all the challenges, depending on the level 645.71s - 648.97s | of difficulty, from easy to hard. 648.97s - 654.13s | And we also, something really important for us, we


chunk_text:
world, you don't know how this is going to be expanded. 598.44s - 605.45s | So we wanted to change things and scale things up. 605.45s - 609.49s | So now let's talk about the approach that we had at Expo. 609.49s - 612.57s | As Joel was saying, we wanted to scale things up. 612.57s - 617.53s | So the first thing that we did was starting collecting thousands of benchmarks from different 617.53s - 620.65s | CTF competitions. 620.65s - 624.49s | We also partnered with some companies that you may know, like Postfigure and Pentester 624.49s - 625.49s | Labs. 625.49s - 631.01s | So they provided to us all the exercises that they have online, and we added to our benchmarks. 631.01s - 636.85s | Also we wanted to collect the most interesting and realistic challenges that we can find, 636.85s - 641.25s | and of course with a great focus in web applications. 641.25s - 645.71s | Also apart from that, we had to categorize all the challenges, depending on the level 645.71s - 648.97s | of difficulty, from easy to hard. 648.97s - 654.13s | And we also, something really important for us, we created a fully autonomous agent, which 654.13s - 657.03s | is connected to an attack machine. 657.03s - 661.49s | And this attack machine not only contains a lot of pentesting tools, but we also added 661.49s - 666.37s | some tools that we use on our daily basis for bug bounty, as we have a lot of experience 666.37s - 669.01s | using them. 669.01s - 675.29s | And apart from that, one thing that is also very important, we wanted to analyze the performance 675.29s - 676.29s | of our solvers. 676.33s - 681.65s | So for that, we created an exclusive set of more than 100 novel benchmarks. 681.65s - 686.37s | These benchmarks are used for validation, and as we are completely sure that the solution 686.37s - 695.85s | is not part of any training data set, we can also evaluate how the AI is performing. 695.85s - 699.67s | And here are the results that we got after three months of work. 699.67s - 706.23s | As you can see, Expo was able to solve 75% of the challenges from Postfigure Labs, 72% 706.23s - 710.99s | of the challenges from Pentester Labs, and


chunk_text:
created a fully autonomous agent, which 654.13s - 657.03s | is connected to an attack machine. 657.03s - 661.49s | And this attack machine not only contains a lot of pentesting tools, but we also added 661.49s - 666.37s | some tools that we use on our daily basis for bug bounty, as we have a lot of experience 666.37s - 669.01s | using them. 669.01s - 675.29s | And apart from that, one thing that is also very important, we wanted to analyze the performance 675.29s - 676.29s | of our solvers. 676.33s - 681.65s | So for that, we created an exclusive set of more than 100 novel benchmarks. 681.65s - 686.37s | These benchmarks are used for validation, and as we are completely sure that the solution 686.37s - 695.85s | is not part of any training data set, we can also evaluate how the AI is performing. 695.85s - 699.67s | And here are the results that we got after three months of work. 699.67s - 706.23s | As you can see, Expo was able to solve 75% of the challenges from Postfigure Labs, 72% 706.23s - 710.99s | of the challenges from Pentester Labs, and all of that without any human interaction. 710.99s - 717.05s | So all the exercises that we were able to solve were completely solved by the AI. 717.05s - 722.11s | Also something really important, talking again about the novel benchmarks, we were able to 722.11s - 724.43s | solve 85% of those. 724.43s - 728.79s | We tried to create these challenges as more representative as possible, and now we are 728.79s - 733.98s | going to see how these challenges were created. 733.98s - 739.46s | So here you have a tree map with a distribution of some vulnerabilities that we added to our 739.46s - 740.46s | benchmarks. 740.46s - 746.22s | As you can see, we tried to be as more realistic as possible, trying to follow a distribution 746.22s - 750.18s | similar to what we see in bug bounties. 750.18s - 755.38s | So you can see here that we have cross-site scripting and IDORS, which probably are one 755.38s - 759.78s | of the most common issues and vulnerabilities that we see when doing bug bounties, and especially 759.78s - 761.34s | in life hacking events. 761.34s - 766.22s | But we also


chunk_text:
all of that without any human interaction. 710.99s - 717.05s | So all the exercises that we were able to solve were completely solved by the AI. 717.05s - 722.11s | Also something really important, talking again about the novel benchmarks, we were able to 722.11s - 724.43s | solve 85% of those. 724.43s - 728.79s | We tried to create these challenges as more representative as possible, and now we are 728.79s - 733.98s | going to see how these challenges were created. 733.98s - 739.46s | So here you have a tree map with a distribution of some vulnerabilities that we added to our 739.46s - 740.46s | benchmarks. 740.46s - 746.22s | As you can see, we tried to be as more realistic as possible, trying to follow a distribution 746.22s - 750.18s | similar to what we see in bug bounties. 750.18s - 755.38s | So you can see here that we have cross-site scripting and IDORS, which probably are one 755.38s - 759.78s | of the most common issues and vulnerabilities that we see when doing bug bounties, and especially 759.78s - 761.34s | in life hacking events. 761.34s - 766.22s | But we also have some vulnerabilities like server-side rigorous forgery, common injections, 766.22s - 768.70s | privileged escalation, and also some CVEs. 768.70s - 773.58s | So we tried to follow a very good distribution to cover all the areas and all the vulnerability 773.58s - 774.58s | types. 774.58s - 779.50s | Also, just in case someone is interested, we are going to share all the benchmarks that 779.50s - 780.50s | we have. 780.50s - 784.86s | So we are planning to publish them in a few weeks, just in case you want to test them 784.86s - 787.86s | against your own agents. 787.86s - 792.38s | So just keep an eye to all the social media and website, as we will be sharing those over 792.38s - 794.86s | there. 794.86s - 801.42s | And here we have some statistics about the success rate that we have, depending on the 801.42s - 802.42s | category. 802.42s - 807.02s | We tried to follow a similar category to what we have in OWASP, which is a reference for 807.02s - 810.94s | all of us that we are doing web pentesting. 810.94s - 815.06s | And as you can see


chunk_text:
have some vulnerabilities like server-side rigorous forgery, common injections, 766.22s - 768.70s | privileged escalation, and also some CVEs. 768.70s - 773.58s | So we tried to follow a very good distribution to cover all the areas and all the vulnerability 773.58s - 774.58s | types. 774.58s - 779.50s | Also, just in case someone is interested, we are going to share all the benchmarks that 779.50s - 780.50s | we have. 780.50s - 784.86s | So we are planning to publish them in a few weeks, just in case you want to test them 784.86s - 787.86s | against your own agents. 787.86s - 792.38s | So just keep an eye to all the social media and website, as we will be sharing those over 792.38s - 794.86s | there. 794.86s - 801.42s | And here we have some statistics about the success rate that we have, depending on the 801.42s - 802.42s | category. 802.42s - 807.02s | We tried to follow a similar category to what we have in OWASP, which is a reference for 807.02s - 810.94s | all of us that we are doing web pentesting. 810.94s - 815.06s | And as you can see here, for some kind of categories, the AI was performing better than 815.06s - 816.58s | others. 816.58s - 821.82s | So let's say, for example, for broken authentication, we can see that OAuth and XAML were performing 821.82s - 824.22s | not that well than in other examples. 824.22s - 828.42s | This is something that we will be talking later, but we are trying to increase this 828.42s - 829.42s | success rate. 829.42s - 834.58s | But for example, for broken authentication, we have very good success. 834.58s - 840.74s | And again, we are failing in CCRF tokens, in CCRF issues. 840.74s - 845.06s | And we have some examples of injection vulnerabilities, which, of course, you all may know. 845.06s - 847.62s | Again, we are failing in DOM XSS. 847.62s - 851.98s | This is basically because at the beginning, when we started doing our agent, we were missing 851.98s - 853.62s | like an embedded browser. 853.62s - 858.82s | So the agent was not able to exploit some issues that requires exploiting something 858.82s - 860.34s | in the browser or in client-side. 860.34s - 863.82s | So this is something that


chunk_text:
here, for some kind of categories, the AI was performing better than 815.06s - 816.58s | others. 816.58s - 821.82s | So let's say, for example, for broken authentication, we can see that OAuth and XAML were performing 821.82s - 824.22s | not that well than in other examples. 824.22s - 828.42s | This is something that we will be talking later, but we are trying to increase this 828.42s - 829.42s | success rate. 829.42s - 834.58s | But for example, for broken authentication, we have very good success. 834.58s - 840.74s | And again, we are failing in CCRF tokens, in CCRF issues. 840.74s - 845.06s | And we have some examples of injection vulnerabilities, which, of course, you all may know. 845.06s - 847.62s | Again, we are failing in DOM XSS. 847.62s - 851.98s | This is basically because at the beginning, when we started doing our agent, we were missing 851.98s - 853.62s | like an embedded browser. 853.62s - 858.82s | So the agent was not able to exploit some issues that requires exploiting something 858.82s - 860.34s | in the browser or in client-side. 860.34s - 863.82s | So this is something that we have improved now, and I think we will be talking later 863.82s - 866.30s | about this. 866.30s - 871.10s | And then finally, some misconfiguration issues that, as you can see here in cache poisoning 871.10s - 873.82s | and cores, is something that we still need to improve. 873.90s - 878.18s | I was really impressed about the blind XSS, because it's not something really easy, and 878.18s - 881.38s | we had a very good success rate. 881.38s - 886.18s | And then talking about the success versus difficulty, we can see that we perform really 886.18s - 889.54s | well for easy and medium vulnerabilities. 889.54s - 894.46s | We have almost 90% from all the benchmarks that we are talking about now. 894.46s - 901.46s | Just to clarify, these statistics belong to Porzweiger, PentesterLab, and our own validation 901.46s - 902.46s | challenges. 902.46s - 906.42s | We also have some other benchmarks that we use for training and that all, but here we 906.42s - 909.86s | are only including those three that we were talking before. 909.86s - 915.02s | And then for hard vulnerabilities, we can see that we have


chunk_text:
we have improved now, and I think we will be talking later 863.82s - 866.30s | about this. 866.30s - 871.10s | And then finally, some misconfiguration issues that, as you can see here in cache poisoning 871.10s - 873.82s | and cores, is something that we still need to improve. 873.90s - 878.18s | I was really impressed about the blind XSS, because it's not something really easy, and 878.18s - 881.38s | we had a very good success rate. 881.38s - 886.18s | And then talking about the success versus difficulty, we can see that we perform really 886.18s - 889.54s | well for easy and medium vulnerabilities. 889.54s - 894.46s | We have almost 90% from all the benchmarks that we are talking about now. 894.46s - 901.46s | Just to clarify, these statistics belong to Porzweiger, PentesterLab, and our own validation 901.46s - 902.46s | challenges. 902.46s - 906.42s | We also have some other benchmarks that we use for training and that all, but here we 906.42s - 909.86s | are only including those three that we were talking before. 909.86s - 915.02s | And then for hard vulnerabilities, we can see that we have 40%. 915.02s - 918.94s | So yeah, of course, we are going to try to improve that. 918.94s - 925.70s | And now here you can see some examples about some vulnerability types that you can see 925.70s - 926.70s | there. 926.70s - 928.90s | And we have one question for all of you. 928.90s - 934.18s | So for those examples that you can see here, I would like to ask you if you think that 934.18s - 937.42s | there is any case that the AI was not able to solve. 937.42s - 943.62s | So somebody has any idea, any number? 943.62s - 948.58s | We give you some seconds so that you can read all of them. 948.58s - 949.58s | Which one? 949.58s - 950.58s | Seven? 950.58s - 951.58s | Okay. 951.58s - 952.58s | Yeah. 952.58s - 958.50s | So this was a tricky question, because in the end, the AI was able to solve all of them. 959.50s - 963.94s | You can see that in our website, we have already shared some of those examples. 963.94s - 967.62s | For example, the Node.js one, the first one, the IDOR. 967.62s


chunk_text:
40%. 915.02s - 918.94s | So yeah, of course, we are going to try to improve that. 918.94s - 925.70s | And now here you can see some examples about some vulnerability types that you can see 925.70s - 926.70s | there. 926.70s - 928.90s | And we have one question for all of you. 928.90s - 934.18s | So for those examples that you can see here, I would like to ask you if you think that 934.18s - 937.42s | there is any case that the AI was not able to solve. 937.42s - 943.62s | So somebody has any idea, any number? 943.62s - 948.58s | We give you some seconds so that you can read all of them. 948.58s - 949.58s | Which one? 949.58s - 950.58s | Seven? 950.58s - 951.58s | Okay. 951.58s - 952.58s | Yeah. 952.58s - 958.50s | So this was a tricky question, because in the end, the AI was able to solve all of them. 959.50s - 963.94s | You can see that in our website, we have already shared some of those examples. 963.94s - 967.62s | For example, the Node.js one, the first one, the IDOR. 967.62s - 972.94s | But now we don't have time to see all of them, but we want to show you three of them. 972.94s - 976.98s | So we are going to start with the reflected XSS. 976.98s - 982.30s | So for the people that like exploiting this issue, you will like this example. 982.30s - 986.22s | In this example, the goal is to exploit an XSS. 986.22s - 989.66s | We have some sort of several filtering in place. 989.66s - 993.22s | So you will see the agent trying to train some default payloads. 993.22s - 996.74s | Then you will see that it tries to use some kind of encodings. 996.74s - 1001.26s | And finally, after realizing how is the way to exploit that, he managed to exploit it 1001.26s - 1004.42s | using HTML entity encoding. 1004.42s - 1006.58s | So let's go to the example. 1006.58s - 1009.86s | Yeah, let me update this. 1009.86s - 1010.86s | Okay. 1010.86s - 1014.58s | So here you have an example of our agent working. 1014.58s - 1020.90s | So this is basically how it looks when we try to provide a challenge with


chunk_text:
- 972.94s | But now we don't have time to see all of them, but we want to show you three of them. 972.94s - 976.98s | So we are going to start with the reflected XSS. 976.98s - 982.30s | So for the people that like exploiting this issue, you will like this example. 982.30s - 986.22s | In this example, the goal is to exploit an XSS. 986.22s - 989.66s | We have some sort of several filtering in place. 989.66s - 993.22s | So you will see the agent trying to train some default payloads. 993.22s - 996.74s | Then you will see that it tries to use some kind of encodings. 996.74s - 1001.26s | And finally, after realizing how is the way to exploit that, he managed to exploit it 1001.26s - 1004.42s | using HTML entity encoding. 1004.42s - 1006.58s | So let's go to the example. 1006.58s - 1009.86s | Yeah, let me update this. 1009.86s - 1010.86s | Okay. 1010.86s - 1014.58s | So here you have an example of our agent working. 1014.58s - 1020.90s | So this is basically how it looks when we try to provide a challenge with a description. 1020.90s - 1023.50s | And we just say, okay, go ahead and hack it. 1023.50s - 1027.62s | So let's go up to see to the very beginning what we have. 1027.62s - 1031.70s | As Joel was mentioning before, we have the description of the challenge. 1031.70s - 1037.18s | In this case, we are only providing the goal to execute an XSS with the string XSS in capital 1037.18s - 1038.30s | letters. 1038.30s - 1041.86s | And we have also information about the target that we want to exploit. 1041.90s - 1048.18s | So if we go a bit down, you can see that first it starts accessing to the web application. 1048.18s - 1051.66s | It finds an endpoint, which is XSS 20. 1051.66s - 1055.06s | And then realizes that there is a potential vulnerable parameter. 1055.06s - 1059.02s | So now it starts trying with a typical payload. 1059.02s - 1062.54s | And it realizes that it fails because it's getting a 405 error. 1062.54s - 1066.46s | This is because it's trying to perform a POST request. 1066.46s - 1070.98s | If we go a bit up to the previous output,


chunk_text:
a description. 1020.90s - 1023.50s | And we just say, okay, go ahead and hack it. 1023.50s - 1027.62s | So let's go up to see to the very beginning what we have. 1027.62s - 1031.70s | As Joel was mentioning before, we have the description of the challenge. 1031.70s - 1037.18s | In this case, we are only providing the goal to execute an XSS with the string XSS in capital 1037.18s - 1038.30s | letters. 1038.30s - 1041.86s | And we have also information about the target that we want to exploit. 1041.90s - 1048.18s | So if we go a bit down, you can see that first it starts accessing to the web application. 1048.18s - 1051.66s | It finds an endpoint, which is XSS 20. 1051.66s - 1055.06s | And then realizes that there is a potential vulnerable parameter. 1055.06s - 1059.02s | So now it starts trying with a typical payload. 1059.02s - 1062.54s | And it realizes that it fails because it's getting a 405 error. 1062.54s - 1066.46s | This is because it's trying to perform a POST request. 1066.46s - 1070.98s | If we go a bit up to the previous output, you can see that there is a form which has 1070.98s - 1071.98s | no action. 1071.98s - 1077.62s | So first it will try it with a POST request and then realizes that it's doing bad and 1077.62s - 1081.58s | changes to GET and tries again with the same payload. 1081.58s - 1086.34s | So if we go a bit down, we can see that the first thing that the AI does is identify that 1086.34s - 1088.58s | there is one character which is being blocked. 1088.58s - 1093.74s | So this is something really important, especially when we want to phase, for example, by passing 1093.74s - 1094.94s | a WAF or something like that. 1094.94s - 1097.06s | We want to know what characters are being filtered. 1097.06s - 1101.82s | So this is something that the agent is realizing by itself, and it's really interesting. 1101.82s - 1104.54s | Then here is something that is really important. 1104.54s - 1109.54s | It fails while trying to craft a request within a space. 1109.54s - 1112.44s | So it realizes that the current request is bad form. 1112.44s - 1117.10s | So then changes, tries


chunk_text:
you can see that there is a form which has 1070.98s - 1071.98s | no action. 1071.98s - 1077.62s | So first it will try it with a POST request and then realizes that it's doing bad and 1077.62s - 1081.58s | changes to GET and tries again with the same payload. 1081.58s - 1086.34s | So if we go a bit down, we can see that the first thing that the AI does is identify that 1086.34s - 1088.58s | there is one character which is being blocked. 1088.58s - 1093.74s | So this is something really important, especially when we want to phase, for example, by passing 1093.74s - 1094.94s | a WAF or something like that. 1094.94s - 1097.06s | We want to know what characters are being filtered. 1097.06s - 1101.82s | So this is something that the agent is realizing by itself, and it's really interesting. 1101.82s - 1104.54s | Then here is something that is really important. 1104.54s - 1109.54s | It fails while trying to craft a request within a space. 1109.54s - 1112.44s | So it realizes that the current request is bad form. 1112.44s - 1117.10s | So then changes, tries to encode the payload, and tries again, which is something that maybe 1117.10s - 1121.50s | we can see when we are trying to do a bounty. 1121.50s - 1124.58s | And then let's go a bit down. 1124.94s - 1129.46s | Here you can see that after trying a couple of payloads, it realizes that it's not able 1129.46s - 1133.30s | to find a good solution, so it tries to change from context. 1133.30s - 1137.78s | At this point, tries to analyze again the application, but then it sees that there is 1137.78s - 1139.50s | nothing interesting apart from that. 1139.50s - 1144.82s | So again, gets the initial goal to exploit the XSS, and goes again to try and exploit 1144.82s - 1146.50s | with different payloads. 1146.50s - 1154.46s | Again, if we go a bit down, we can see that, again, changes from the initial goal and starts 1154.46s - 1158.90s | trying to see if it can fuzz the application, trying to do some brute force, and trying 1158.90s - 1162.90s | to see if it can find any additional endpoint that might be vulnerable. 1162.90s - 1169.18s | Again, it says,


chunk_text:
to encode the payload, and tries again, which is something that maybe 1117.10s - 1121.50s | we can see when we are trying to do a bounty. 1121.50s - 1124.58s | And then let's go a bit down. 1124.94s - 1129.46s | Here you can see that after trying a couple of payloads, it realizes that it's not able 1129.46s - 1133.30s | to find a good solution, so it tries to change from context. 1133.30s - 1137.78s | At this point, tries to analyze again the application, but then it sees that there is 1137.78s - 1139.50s | nothing interesting apart from that. 1139.50s - 1144.82s | So again, gets the initial goal to exploit the XSS, and goes again to try and exploit 1144.82s - 1146.50s | with different payloads. 1146.50s - 1154.46s | Again, if we go a bit down, we can see that, again, changes from the initial goal and starts 1154.46s - 1158.90s | trying to see if it can fuzz the application, trying to do some brute force, and trying 1158.90s - 1162.90s | to see if it can find any additional endpoint that might be vulnerable. 1162.90s - 1169.18s | Again, it says, okay, this is not the way to go, so start again with another payload. 1169.18s - 1175.02s | And there's one point when it realizes that he's able to bypass the filters by using HTML 1175.02s - 1178.40s | entity encoding with JavaScript string manipulation. 1178.40s - 1183.26s | And then after a few attempts, it managed to get a payload that is working. 1183.26s - 1189.14s | You can see all the encoded output, and if we go to the response, we can see the alert 1189.14s - 1194.06s | and the flag of the challenge who has been retrieved. 1194.06s - 1196.22s | So yeah, that was our first example. 1196.22s - 1198.78s | Thank you. 1198.78s - 1208.02s | If we go to the next one, here we have an image uploader vulnerability. 1208.02s - 1211.90s | We know that we have some extensions that are being filtered by the application. 1211.90s - 1216.70s | So one thing that is really interesting in this example is that Expo has to deal with 1216.74s - 1218.74s | some CSRF token and session cookies. 1218.74s - 1223.54s | You will see that it struggles with that because it's something


chunk_text:
okay, this is not the way to go, so start again with another payload. 1169.18s - 1175.02s | And there's one point when it realizes that he's able to bypass the filters by using HTML 1175.02s - 1178.40s | entity encoding with JavaScript string manipulation. 1178.40s - 1183.26s | And then after a few attempts, it managed to get a payload that is working. 1183.26s - 1189.14s | You can see all the encoded output, and if we go to the response, we can see the alert 1189.14s - 1194.06s | and the flag of the challenge who has been retrieved. 1194.06s - 1196.22s | So yeah, that was our first example. 1196.22s - 1198.78s | Thank you. 1198.78s - 1208.02s | If we go to the next one, here we have an image uploader vulnerability. 1208.02s - 1211.90s | We know that we have some extensions that are being filtered by the application. 1211.90s - 1216.70s | So one thing that is really interesting in this example is that Expo has to deal with 1216.74s - 1218.74s | some CSRF token and session cookies. 1218.74s - 1223.54s | You will see that it struggles with that because it's something that we have to do manually. 1223.54s - 1229.42s | So after that, he managed to log in the application, then tries to upload a PHP web shell, plays 1229.42s - 1235.70s | again with some extensions, until it finally exploited by uploading an htaccess file. 1235.70s - 1238.14s | So let's go to the next example. 1238.14s - 1245.26s | Let me update this one. 1245.30s - 1250.78s | So here, in this case, you can see, again, the trace working. 1250.78s - 1255.50s | We can see that in this description, which is a challenge from Porswiger, we have a very 1255.50s - 1256.70s | detailed description. 1256.70s - 1261.82s | So the first thing that says is that we have to exploit, again, an image upload function. 1261.82s - 1267.50s | It says that in this case, the goal is to exploit and retrieve the content of the secret, 1267.50s - 1271.50s | which is inside the server, and then also provide some credentials that you can use 1271.50s - 1272.66s | for authenticate. 1272.66s - 1277.54s | So the agent will take all this information, and from that point, we'll start working. 1277.54s - 1282.06s |


chunk_text:
that we have to do manually. 1223.54s - 1229.42s | So after that, he managed to log in the application, then tries to upload a PHP web shell, plays 1229.42s - 1235.70s | again with some extensions, until it finally exploited by uploading an htaccess file. 1235.70s - 1238.14s | So let's go to the next example. 1238.14s - 1245.26s | Let me update this one. 1245.30s - 1250.78s | So here, in this case, you can see, again, the trace working. 1250.78s - 1255.50s | We can see that in this description, which is a challenge from Porswiger, we have a very 1255.50s - 1256.70s | detailed description. 1256.70s - 1261.82s | So the first thing that says is that we have to exploit, again, an image upload function. 1261.82s - 1267.50s | It says that in this case, the goal is to exploit and retrieve the content of the secret, 1267.50s - 1271.50s | which is inside the server, and then also provide some credentials that you can use 1271.50s - 1272.66s | for authenticate. 1272.66s - 1277.54s | So the agent will take all this information, and from that point, we'll start working. 1277.54s - 1282.06s | So if we go a bit down, you can see, again, that it starts to access the application. 1282.06s - 1287.50s | It sees that there is some redirect, so it follows that, and then tries to use the credentials 1287.50s - 1290.94s | to authenticate that were provided in the description. 1290.94s - 1294.46s | At this point, it sees that it's missing a CSRF parameter. 1294.46s - 1298.82s | So in these old comments, I'm going to scroll again. 1298.86s - 1303.98s | It will start to understand how the CSRF token works, how it has to deal with that part, 1303.98s - 1305.82s | which is new to him. 1305.82s - 1311.54s | And finally, after playing around with session cookies and playing around with the CSRF token, 1311.54s - 1316.26s | there is a point where it realizes that, okay, I'm going to do this in only one step. 1316.26s - 1321.10s | So it creates this bash example with first access to the login page, retrieves the session 1321.10s - 1326.94s | cookie and the CSRF token to have that updated, and then, for that point, uses that to log 1326.94s - 1329.78s | in


chunk_text:
So if we go a bit down, you can see, again, that it starts to access the application. 1282.06s - 1287.50s | It sees that there is some redirect, so it follows that, and then tries to use the credentials 1287.50s - 1290.94s | to authenticate that were provided in the description. 1290.94s - 1294.46s | At this point, it sees that it's missing a CSRF parameter. 1294.46s - 1298.82s | So in these old comments, I'm going to scroll again. 1298.86s - 1303.98s | It will start to understand how the CSRF token works, how it has to deal with that part, 1303.98s - 1305.82s | which is new to him. 1305.82s - 1311.54s | And finally, after playing around with session cookies and playing around with the CSRF token, 1311.54s - 1316.26s | there is a point where it realizes that, okay, I'm going to do this in only one step. 1316.26s - 1321.10s | So it creates this bash example with first access to the login page, retrieves the session 1321.10s - 1326.94s | cookie and the CSRF token to have that updated, and then, for that point, uses that to log 1326.94s - 1329.78s | in to the application with the provided credentials. 1329.78s - 1334.34s | And finally, as you can see here, we access to the application, okay? 1334.34s - 1337.78s | So we are now this user winner with this session. 1337.78s - 1341.30s | Okay, so now the next point is trying to upload the web shell. 1341.30s - 1345.42s | So it will try to go and create a PHP file. 1345.42s - 1346.42s | It fails. 1346.42s - 1351.18s | We are getting some errors here in the output, as you can see here, like PHP files are not 1351.18s - 1352.18s | upload. 1352.18s - 1354.66s | So that tries again with a double extension. 1354.66s - 1358.98s | If we go and scroll a bit, we can see that eventually we'll try with another extension, 1358.98s - 1360.86s | the phtml. 1360.86s - 1365.62s | And then, finally, sorry, oh, yeah, sorry. 1365.62s - 1371.52s | And after that, we see, which is really, really important and interesting, is that it tries 1371.52s - 1373.94s | to upload an HT access. 1373.94s - 1379.66s | In this case, what it's trying to do is it's trying to get


chunk_text:
to the application with the provided credentials. 1329.78s - 1334.34s | And finally, as you can see here, we access to the application, okay? 1334.34s - 1337.78s | So we are now this user winner with this session. 1337.78s - 1341.30s | Okay, so now the next point is trying to upload the web shell. 1341.30s - 1345.42s | So it will try to go and create a PHP file. 1345.42s - 1346.42s | It fails. 1346.42s - 1351.18s | We are getting some errors here in the output, as you can see here, like PHP files are not 1351.18s - 1352.18s | upload. 1352.18s - 1354.66s | So that tries again with a double extension. 1354.66s - 1358.98s | If we go and scroll a bit, we can see that eventually we'll try with another extension, 1358.98s - 1360.86s | the phtml. 1360.86s - 1365.62s | And then, finally, sorry, oh, yeah, sorry. 1365.62s - 1371.52s | And after that, we see, which is really, really important and interesting, is that it tries 1371.52s - 1373.94s | to upload an HT access. 1373.94s - 1379.66s | In this case, what it's trying to do is it's trying to get any image file that can execute 1379.66s - 1381.82s | PHP code. 1382.02s - 1386.22s | I ask you here, how many times we were doing like a pen test, and maybe we forgot of doing 1386.22s - 1390.90s | or trying these kind of things, like loading an HT access, to see if we can replace that 1390.90s - 1398.34s | and we can execute PHP code in an image file, which at the beginning was filtered. 1398.34s - 1400.98s | And yeah, after that, it just access to the application. 1400.98s - 1402.42s | It tries a couple times. 1402.42s - 1407.34s | Sorry for doing a scroll, but I don't want to waste too much time in this. 1407.34s - 1411.22s | So eventually, let's go to the final one. 1411.22s - 1418.98s | Yeah, here we can see that after uploading the PHP file, it can execute this command, 1418.98s - 1426.26s | access to the secret key, and then submitting it to the submit solution, which is over here. 1426.26s - 1436.25s | We can get the flag. 1436.25s - 1440.41s | So something interesting about all these cases is that the AI is also


chunk_text:
any image file that can execute 1379.66s - 1381.82s | PHP code. 1382.02s - 1386.22s | I ask you here, how many times we were doing like a pen test, and maybe we forgot of doing 1386.22s - 1390.90s | or trying these kind of things, like loading an HT access, to see if we can replace that 1390.90s - 1398.34s | and we can execute PHP code in an image file, which at the beginning was filtered. 1398.34s - 1400.98s | And yeah, after that, it just access to the application. 1400.98s - 1402.42s | It tries a couple times. 1402.42s - 1407.34s | Sorry for doing a scroll, but I don't want to waste too much time in this. 1407.34s - 1411.22s | So eventually, let's go to the final one. 1411.22s - 1418.98s | Yeah, here we can see that after uploading the PHP file, it can execute this command, 1418.98s - 1426.26s | access to the secret key, and then submitting it to the submit solution, which is over here. 1426.26s - 1436.25s | We can get the flag. 1436.25s - 1440.41s | So something interesting about all these cases is that the AI is also being able to take 1440.45s - 1446.49s | goals, like exfiltrating this file and submitting the secret to the endpoint to get the flag. 1446.49s - 1450.93s | All these kind of details are things that we are not used to seeing in any tool, or 1450.93s - 1455.45s | even if we want to test some particular functions of our web application, that's also super 1455.45s - 1458.85s | interesting to see and is able to manage. 1458.85s - 1465.05s | So now, the last example that we are going to see now, and then after that, we are going 1465.09s - 1471.37s | to see some experiments that we have done, is this is a super interesting case because 1471.37s - 1474.45s | we have provided no goal to the AI in this case. 1474.45s - 1480.57s | We are going to see that we are going just to present a typical random text, as in any 1480.57s - 1487.25s | CTF, that makes no sense and just confuses you, the target, and the AI will start exploring 1487.25s - 1491.29s | the web application and trying to pursue that goal, right? 1491.29s - 1494.93s | Because since


chunk_text:
being able to take 1440.45s - 1446.49s | goals, like exfiltrating this file and submitting the secret to the endpoint to get the flag. 1446.49s - 1450.93s | All these kind of details are things that we are not used to seeing in any tool, or 1450.93s - 1455.45s | even if we want to test some particular functions of our web application, that's also super 1455.45s - 1458.85s | interesting to see and is able to manage. 1458.85s - 1465.05s | So now, the last example that we are going to see now, and then after that, we are going 1465.09s - 1471.37s | to see some experiments that we have done, is this is a super interesting case because 1471.37s - 1474.45s | we have provided no goal to the AI in this case. 1474.45s - 1480.57s | We are going to see that we are going just to present a typical random text, as in any 1480.57s - 1487.25s | CTF, that makes no sense and just confuses you, the target, and the AI will start exploring 1487.25s - 1491.29s | the web application and trying to pursue that goal, right? 1491.29s - 1494.93s | Because since it doesn't have a goal, it needs to find out what to do and how to hack the 1494.93s - 1498.73s | website. 1498.73s - 1506.57s | So let's go to the challenge, let's refresh this, and as you can see, the description 1506.57s - 1512.33s | is saggy quack quack, try to quack me, that makes no sense, and any of us doing a CTF 1512.33s - 1518.53s | will be confused, and we also get some information about the target. 1518.53s - 1524.01s | Based on that, the agent understands that this is a CTF description and pursues to go 1524.01s - 1527.77s | and start doing some recon on the web application. 1527.77s - 1534.05s | So first of all, access to the root, then to a login website, and notice that there 1534.05s - 1539.01s | is some JavaScript file, so decide to go and analyze the JavaScript all by itself. 1539.01s - 1544.13s | We're going to see this behavior is repeated during the whole trace because every time 1544.13s - 1548.69s | that it's detecting a new JavaScript, it's reading and understanding that file to improve 1548.69s - 1553.25s | the knowledge about the


chunk_text:
it doesn't have a goal, it needs to find out what to do and how to hack the 1494.93s - 1498.73s | website. 1498.73s - 1506.57s | So let's go to the challenge, let's refresh this, and as you can see, the description 1506.57s - 1512.33s | is saggy quack quack, try to quack me, that makes no sense, and any of us doing a CTF 1512.33s - 1518.53s | will be confused, and we also get some information about the target. 1518.53s - 1524.01s | Based on that, the agent understands that this is a CTF description and pursues to go 1524.01s - 1527.77s | and start doing some recon on the web application. 1527.77s - 1534.05s | So first of all, access to the root, then to a login website, and notice that there 1534.05s - 1539.01s | is some JavaScript file, so decide to go and analyze the JavaScript all by itself. 1539.01s - 1544.13s | We're going to see this behavior is repeated during the whole trace because every time 1544.13s - 1548.69s | that it's detecting a new JavaScript, it's reading and understanding that file to improve 1548.69s - 1553.25s | the knowledge about the application and keep digging deeper until it finds some particular 1553.25s - 1555.65s | goal to exploit. 1555.65s - 1561.89s | So once it learns about the login, it's going to test some test test user as we always do 1561.89s - 1564.61s | when doing appendix to see how it behaves. 1564.61s - 1568.89s | Of course it doesn't work, but the application understands that the login is working. 1568.89s - 1575.17s | So after that, try some basic payloads for SQL injection, doesn't work either, we get 1575.17s - 1581.25s | the same message, and now we craft just a quick Python script to do some default credentials 1581.25s - 1586.01s | for the admin user, just trying some few well-known passwords to see if anything of 1586.01s - 1589.69s | that is a low-hanging fruit that can get quickly. 1589.69s - 1594.29s | None of them work, of course, so it decides to move on and try NoSQL injection against 1594.29s - 1603.05s | the login, doesn't have lag anymore, so decides to just try some JSON parameter injection 1603.05s - 1607.85s | to see if also can get some unexpected behavior on the application. 1607.89s -


chunk_text:
application and keep digging deeper until it finds some particular 1553.25s - 1555.65s | goal to exploit. 1555.65s - 1561.89s | So once it learns about the login, it's going to test some test test user as we always do 1561.89s - 1564.61s | when doing appendix to see how it behaves. 1564.61s - 1568.89s | Of course it doesn't work, but the application understands that the login is working. 1568.89s - 1575.17s | So after that, try some basic payloads for SQL injection, doesn't work either, we get 1575.17s - 1581.25s | the same message, and now we craft just a quick Python script to do some default credentials 1581.25s - 1586.01s | for the admin user, just trying some few well-known passwords to see if anything of 1586.01s - 1589.69s | that is a low-hanging fruit that can get quickly. 1589.69s - 1594.29s | None of them work, of course, so it decides to move on and try NoSQL injection against 1594.29s - 1603.05s | the login, doesn't have lag anymore, so decides to just try some JSON parameter injection 1603.05s - 1607.85s | to see if also can get some unexpected behavior on the application. 1607.89s - 1612.89s | It didn't work either, so now it decides to go to the initial recon and say, okay, let's 1612.89s - 1619.69s | see what other endpoints we have, and it realized that there was one endpoint called post create. 1619.69s - 1624.17s | When it tried to access this endpoint, it realized it requires authentication, and in 1624.17s - 1628.69s | this application, the main feature is that users can create posts, like in any social 1628.69s - 1635.25s | media, so it decides to go and go to the endpoint for register an account, again, as we have 1635.25s - 1640.49s | seen in other examples, it's going to access the endpoint, read the JavaScript file, understand 1640.49s - 1646.85s | how the form works to register a user, and it's going to try to register a test user. 1646.85s - 1652.45s | This works, and the user is registered, so now we move on to, again, use those credentials 1652.45s - 1659.09s | and keep getting more access to the application and perform some authenticated tests. 1659.09s - 1662.97s | If we scroll a little bit down, we're going to see now that it tries to


chunk_text:
1612.89s | It didn't work either, so now it decides to go to the initial recon and say, okay, let's 1612.89s - 1619.69s | see what other endpoints we have, and it realized that there was one endpoint called post create. 1619.69s - 1624.17s | When it tried to access this endpoint, it realized it requires authentication, and in 1624.17s - 1628.69s | this application, the main feature is that users can create posts, like in any social 1628.69s - 1635.25s | media, so it decides to go and go to the endpoint for register an account, again, as we have 1635.25s - 1640.49s | seen in other examples, it's going to access the endpoint, read the JavaScript file, understand 1640.49s - 1646.85s | how the form works to register a user, and it's going to try to register a test user. 1646.85s - 1652.45s | This works, and the user is registered, so now we move on to, again, use those credentials 1652.45s - 1659.09s | and keep getting more access to the application and perform some authenticated tests. 1659.09s - 1662.97s | If we scroll a little bit down, we're going to see now that it tries to access again to 1663.01s - 1668.37s | this endpoint, providing the cookies, and this endpoint works, retrieves the JavaScript 1668.37s - 1675.41s | file, gets more information about the application, and now decides just to do a simple post, 1675.41s - 1680.01s | like we always do, like we're testing the website, we want to learn how the application 1680.01s - 1686.61s | behaves, so this works, it creates a post, so now it knows, based on everything that 1686.61s - 1690.77s | has been from the HTML and JavaScript files, that all the posts can be accessed on this 1690.77s - 1700.13s | endpoint for the test user, so when it accesses, we can see here the post being printed, but 1700.13s - 1704.13s | also, if we pay attention, we're going to see that there is a report to admin feature 1704.13s - 1709.85s | that is a little bottom here, and this is super interesting, because now the AI is realizing 1709.85s - 1714.81s | that there is a report to admin feature, and it has found a potential attack vector. 1714.81s - 1719.21s | At this point, we didn't have any goal, but now the AI


chunk_text:
access again to 1663.01s - 1668.37s | this endpoint, providing the cookies, and this endpoint works, retrieves the JavaScript 1668.37s - 1675.41s | file, gets more information about the application, and now decides just to do a simple post, 1675.41s - 1680.01s | like we always do, like we're testing the website, we want to learn how the application 1680.01s - 1686.61s | behaves, so this works, it creates a post, so now it knows, based on everything that 1686.61s - 1690.77s | has been from the HTML and JavaScript files, that all the posts can be accessed on this 1690.77s - 1700.13s | endpoint for the test user, so when it accesses, we can see here the post being printed, but 1700.13s - 1704.13s | also, if we pay attention, we're going to see that there is a report to admin feature 1704.13s - 1709.85s | that is a little bottom here, and this is super interesting, because now the AI is realizing 1709.85s - 1714.81s | that there is a report to admin feature, and it has found a potential attack vector. 1714.81s - 1719.21s | At this point, we didn't have any goal, but now the AI understands that there is an admin 1719.25s - 1723.57s | user that could potentially be reviewing the reports, so it decides to go ahead and try 1723.57s - 1728.57s | some exploits on payloads to see if it can force any type of interaction. 1728.57s - 1733.21s | Remember that this is a CTF, so it's expecting to have something to leak or to exploit in 1733.21s - 1735.93s | order to retrieve the flag. 1735.93s - 1740.65s | So once it learns how it works based on the JavaScript, it's going to just do a report 1740.65s - 1747.53s | of this case, to see if it works, it worked, so now it decides to start collecting more 1747.57s - 1752.37s | information for one of the final payloads, and creates a super interesting script, because 1752.37s - 1754.01s | in this case, it's taking care of everything. 1754.01s - 1758.93s | It's creating a new user, it's reusing those credentials to log in in the application, 1758.93s - 1765.01s | then grabbing the cookie, setting a payload for a client-side exploit to try to send some 1765.01s - 1769.85s | fetch request to our collaboration server, another interesting


chunk_text:
understands that there is an admin 1719.25s - 1723.57s | user that could potentially be reviewing the reports, so it decides to go ahead and try 1723.57s - 1728.57s | some exploits on payloads to see if it can force any type of interaction. 1728.57s - 1733.21s | Remember that this is a CTF, so it's expecting to have something to leak or to exploit in 1733.21s - 1735.93s | order to retrieve the flag. 1735.93s - 1740.65s | So once it learns how it works based on the JavaScript, it's going to just do a report 1740.65s - 1747.53s | of this case, to see if it works, it worked, so now it decides to start collecting more 1747.57s - 1752.37s | information for one of the final payloads, and creates a super interesting script, because 1752.37s - 1754.01s | in this case, it's taking care of everything. 1754.01s - 1758.93s | It's creating a new user, it's reusing those credentials to log in in the application, 1758.93s - 1765.01s | then grabbing the cookie, setting a payload for a client-side exploit to try to send some 1765.01s - 1769.85s | fetch request to our collaboration server, another interesting case of this, understand 1769.85s - 1773.57s | what the collaboration server is and how to use it, how to interact with it, and use the 1773.57s - 1778.17s | payloads, and then we'll create just the post, trigger the report, and then wait for 1778.17s - 1779.53s | some interactions. 1779.53s - 1783.93s | Of course, it's five seconds because it's a CTF, we expect some kind of quick interaction 1783.93s - 1784.93s | in this case. 1784.93s - 1791.25s | Again, it tries a different payload to see if it can trigger any interaction, the, something 1791.25s - 1794.29s | interesting here is that it's not creating the user anymore, because they understand 1794.29s - 1797.93s | that they already have this, so it removes that part from the script, and keep improving 1797.93s - 1800.41s | it to make better results. 1800.41s - 1805.89s | Doesn't work either, so it goes on, try one more time, with a different payload, and again, 1805.89s - 1811.77s | sending the DOM of the application for the admin user, it sends it, and after that, it 1811.77s - 1817.29s | gets that interaction on the interactive server that we have,


chunk_text:
case of this, understand 1769.85s - 1773.57s | what the collaboration server is and how to use it, how to interact with it, and use the 1773.57s - 1778.17s | payloads, and then we'll create just the post, trigger the report, and then wait for 1778.17s - 1779.53s | some interactions. 1779.53s - 1783.93s | Of course, it's five seconds because it's a CTF, we expect some kind of quick interaction 1783.93s - 1784.93s | in this case. 1784.93s - 1791.25s | Again, it tries a different payload to see if it can trigger any interaction, the, something 1791.25s - 1794.29s | interesting here is that it's not creating the user anymore, because they understand 1794.29s - 1797.93s | that they already have this, so it removes that part from the script, and keep improving 1797.93s - 1800.41s | it to make better results. 1800.41s - 1805.89s | Doesn't work either, so it goes on, try one more time, with a different payload, and again, 1805.89s - 1811.77s | sending the DOM of the application for the admin user, it sends it, and after that, it 1811.77s - 1817.29s | gets that interaction on the interactive server that we have, and it's super interesting to 1817.29s - 1821.73s | see that it understands that this is an interaction for an admin that has access to the website 1821.73s - 1826.53s | and is able to retrieve the whole DOM of the application, and if we try to search for the 1826.53s - 1834.65s | flag, oops, well, like the flag, we are going to see that all this here is URL encoded, 1834.65s - 1838.17s | but this is the flag that has exfiltrated from the DOM of the admin user. 1838.17s - 1841.97s | With that, the AI understands that the challenge has successfully finished, and has everything 1841.97s - 1853.00s | it needs to complete the challenge. 1853.00s - 1858.64s | So too many examples, and too many scrolling, so now let's jump to something different, 1858.64s - 1864.86s | a different experiment we did, and it's to know if can AI be compared to human pen testers. 1864.86s - 1869.38s | So for this, we did an experiment that you may have seen in the internet, that we published 1869.38s - 1878.86s | some of the results, and here on the screen, you are going to see


chunk_text:
and it's super interesting to 1817.29s - 1821.73s | see that it understands that this is an interaction for an admin that has access to the website 1821.73s - 1826.53s | and is able to retrieve the whole DOM of the application, and if we try to search for the 1826.53s - 1834.65s | flag, oops, well, like the flag, we are going to see that all this here is URL encoded, 1834.65s - 1838.17s | but this is the flag that has exfiltrated from the DOM of the admin user. 1838.17s - 1841.97s | With that, the AI understands that the challenge has successfully finished, and has everything 1841.97s - 1853.00s | it needs to complete the challenge. 1853.00s - 1858.64s | So too many examples, and too many scrolling, so now let's jump to something different, 1858.64s - 1864.86s | a different experiment we did, and it's to know if can AI be compared to human pen testers. 1864.86s - 1869.38s | So for this, we did an experiment that you may have seen in the internet, that we published 1869.38s - 1878.86s | some of the results, and here on the screen, you are going to see both terminals, one screenshot 1878.86s - 1882.58s | is the pen tester working, and the other one is the AI working at the same time, trying 1882.58s - 1884.98s | to solve the same challenge. 1884.98s - 1887.82s | Something interesting about this case is that you're going to see images, because now we 1887.82s - 1893.90s | have built in a new browser for the AI, so it can understand buttons, everything, and 1893.90s - 1898.30s | more JavaScript application-based, so it improves the results a lot on the client-side 1898.30s - 1899.30s | applications. 1899.30s - 1904.38s | And if you keep tracking the numbers, you are going to see that after the AI finished 1904.38s - 1910.50s | in four minutes, the pen tester is still struggling, like, 20 minutes more to exploit this vulnerability 1910.50s - 1912.26s | and this challenge. 1912.26s - 1916.58s | So for this, we hired five pen testers from different companies, going from junior to 1916.58s - 1918.84s | principal. 1918.84s - 1923.70s | We gave them 40 hours to solve all of the validation cases that they were able to solve 1923.70s - 1926.18s | from our validation set. 1926.18s


chunk_text:
both terminals, one screenshot 1878.86s - 1882.58s | is the pen tester working, and the other one is the AI working at the same time, trying 1882.58s - 1884.98s | to solve the same challenge. 1884.98s - 1887.82s | Something interesting about this case is that you're going to see images, because now we 1887.82s - 1893.90s | have built in a new browser for the AI, so it can understand buttons, everything, and 1893.90s - 1898.30s | more JavaScript application-based, so it improves the results a lot on the client-side 1898.30s - 1899.30s | applications. 1899.30s - 1904.38s | And if you keep tracking the numbers, you are going to see that after the AI finished 1904.38s - 1910.50s | in four minutes, the pen tester is still struggling, like, 20 minutes more to exploit this vulnerability 1910.50s - 1912.26s | and this challenge. 1912.26s - 1916.58s | So for this, we hired five pen testers from different companies, going from junior to 1916.58s - 1918.84s | principal. 1918.84s - 1923.70s | We gave them 40 hours to solve all of the validation cases that they were able to solve 1923.70s - 1926.18s | from our validation set. 1926.18s - 1933.70s | They could use any tools, no exceptions, they could do whatever they want, just a real CTF. 1933.70s - 1938.02s | The thing is that, well, I'm just going to let it continue just a few seconds so you 1938.02s - 1942.50s | can see how the AI has finished, and the pen tester is still working on the challenge up 1942.50s - 1947.46s | to 19 minutes, approximately. 1947.46s - 1953.42s | So the results from this experiment were quite interesting, and let us understand much more 1953.62s - 1957.66s | how these things work and how they can be applied to our field. 1957.66s - 1965.06s | So on this chart, you can see how Expo obtained the same results as the principal, both solving 1965.06s - 1970.90s | the 85% of this challenge from the validation set. 1970.90s - 1977.22s | And on the other chart, you can see their resolutions, percentage made by difficulty. 1977.22s - 1982.34s | And if you pay attention to the easy and medium, you are going to see that the AI excels the 1982.38s - 1984.66s | human pen tester and perform better results. 1984.86s - 1989.66s |


chunk_text:
- 1933.70s | They could use any tools, no exceptions, they could do whatever they want, just a real CTF. 1933.70s - 1938.02s | The thing is that, well, I'm just going to let it continue just a few seconds so you 1938.02s - 1942.50s | can see how the AI has finished, and the pen tester is still working on the challenge up 1942.50s - 1947.46s | to 19 minutes, approximately. 1947.46s - 1953.42s | So the results from this experiment were quite interesting, and let us understand much more 1953.62s - 1957.66s | how these things work and how they can be applied to our field. 1957.66s - 1965.06s | So on this chart, you can see how Expo obtained the same results as the principal, both solving 1965.06s - 1970.90s | the 85% of this challenge from the validation set. 1970.90s - 1977.22s | And on the other chart, you can see their resolutions, percentage made by difficulty. 1977.22s - 1982.34s | And if you pay attention to the easy and medium, you are going to see that the AI excels the 1982.38s - 1984.66s | human pen tester and perform better results. 1984.86s - 1989.66s | However, as Diego mentioned before, for the hard challenges, the AI is struggling a little 1989.66s - 1994.58s | bit more, and those cases that require more creativity, alternative thinking, or more 1994.58s - 1998.58s | careful process, the human excels in those cases. 1999.02s - 2004.82s | So this gives us a huge hint about how this can be applied to our field, where we can 2004.82s - 2009.90s | imagine a place where the AI is taking care of all those things that are less interesting 2009.90s - 2015.26s | for us and leaving the human experts the work of working on the more exciting parts 2015.26s - 2017.46s | of or more challenging parts of the application. 2021.80s - 2026.24s | OK, and now we go to our last question for today. 2026.56s - 2030.20s | So can AI actually be our second brain or assistant? 2030.68s - 2037.24s | So we know that AI has been very useful in multiple contexts, but we haven't seen before 2037.64s - 2043.52s | how we can use the AI to assist a pen tester or a backhunter, in this case, for the people 2043.52s - 2044.84s | that are


chunk_text:
However, as Diego mentioned before, for the hard challenges, the AI is struggling a little 1989.66s - 1994.58s | bit more, and those cases that require more creativity, alternative thinking, or more 1994.58s - 1998.58s | careful process, the human excels in those cases. 1999.02s - 2004.82s | So this gives us a huge hint about how this can be applied to our field, where we can 2004.82s - 2009.90s | imagine a place where the AI is taking care of all those things that are less interesting 2009.90s - 2015.26s | for us and leaving the human experts the work of working on the more exciting parts 2015.26s - 2017.46s | of or more challenging parts of the application. 2021.80s - 2026.24s | OK, and now we go to our last question for today. 2026.56s - 2030.20s | So can AI actually be our second brain or assistant? 2030.68s - 2037.24s | So we know that AI has been very useful in multiple contexts, but we haven't seen before 2037.64s - 2043.52s | how we can use the AI to assist a pen tester or a backhunter, in this case, for the people 2043.52s - 2044.84s | that are interesting here. 2045.24s - 2050.60s | So for this meaning, we use something called human in the loop, we have been talking about 2050.96s - 2057.04s | before. So here we have a prototype in what we wanted to do is basically analyze how we 2057.04s - 2062.92s | can use AI to perform better the work of the human. 2063.36s - 2069.40s | OK, so yeah, here is a small video, which just let it run. 2070.00s - 2074.40s | But basically what we wanted to create was a prototype that basically will provide some 2074.40s - 2081.96s | goals. Apart from that goal, what we can do is provide some feedback to the AI so we can 2081.96s - 2083.88s | change the workflow and how it works. 2084.04s - 2088.64s | So, for example, if we are analyzing how the AI is performing and what kind of software is 2088.64s - 2093.76s | trying to do, we can go in the middle and we can try and change that workflow. 2093.80s - 2097.36s | So, for example, if we see that it's trying to execute a command that it's fed, we can 2097.36s - 2100.64s | modify


chunk_text:
interesting here. 2045.24s - 2050.60s | So for this meaning, we use something called human in the loop, we have been talking about 2050.96s - 2057.04s | before. So here we have a prototype in what we wanted to do is basically analyze how we 2057.04s - 2062.92s | can use AI to perform better the work of the human. 2063.36s - 2069.40s | OK, so yeah, here is a small video, which just let it run. 2070.00s - 2074.40s | But basically what we wanted to create was a prototype that basically will provide some 2074.40s - 2081.96s | goals. Apart from that goal, what we can do is provide some feedback to the AI so we can 2081.96s - 2083.88s | change the workflow and how it works. 2084.04s - 2088.64s | So, for example, if we are analyzing how the AI is performing and what kind of software is 2088.64s - 2093.76s | trying to do, we can go in the middle and we can try and change that workflow. 2093.80s - 2097.36s | So, for example, if we see that it's trying to execute a command that it's fed, we can 2097.36s - 2100.64s | modify that and let the AI interact and continue with that. 2100.92s - 2105.72s | Also, if we see that, for example, it's trying to exploit an SQL injection and we see that 2105.72s - 2110.56s | it's missing some payloads or it's missing some entry points, we can also provide that as 2110.56s - 2116.28s | part of the learnings and we can say to the AI that he has to be and follow that right 2116.32s - 2118.84s | path. So this is just a prototype, an example. 2118.84s - 2122.64s | This is not something that we are pretending to sell or everything like that. 2122.88s - 2127.68s | We just wanted to see how we can interact with the human in the loop. 2129.72s - 2131.00s | So let's skip this one. 2132.04s - 2138.24s | OK, and now to sum up, we're going to be reviewing again the three questions that we 2138.24s - 2140.12s | have been talking about before. 2140.44s - 2144.92s | So for the first question of all, if we can mimic human back hunters. 2145.20s - 2150.80s | OK, we have seen that the AI is surprisingly good for some examples,


chunk_text:
that and let the AI interact and continue with that. 2100.92s - 2105.72s | Also, if we see that, for example, it's trying to exploit an SQL injection and we see that 2105.72s - 2110.56s | it's missing some payloads or it's missing some entry points, we can also provide that as 2110.56s - 2116.28s | part of the learnings and we can say to the AI that he has to be and follow that right 2116.32s - 2118.84s | path. So this is just a prototype, an example. 2118.84s - 2122.64s | This is not something that we are pretending to sell or everything like that. 2122.88s - 2127.68s | We just wanted to see how we can interact with the human in the loop. 2129.72s - 2131.00s | So let's skip this one. 2132.04s - 2138.24s | OK, and now to sum up, we're going to be reviewing again the three questions that we 2138.24s - 2140.12s | have been talking about before. 2140.44s - 2144.92s | So for the first question of all, if we can mimic human back hunters. 2145.20s - 2150.80s | OK, we have seen that the AI is surprisingly good for some examples, especially the easy 2150.80s - 2151.76s | ones and the medium ones. 2152.08s - 2156.20s | But depending on the difficulty, we have to improve the performance. 2156.76s - 2162.68s | Then talking about if we can compare human pen testers to AI, as Joel was talking 2162.68s - 2167.52s | before, expert human excel such creativity and are really, really good at hard 2167.52s - 2172.08s | challenges. But yeah, the AI is faster and better. 2172.12s - 2177.12s | We saw in the example that we provided like five pen testers, we gave them like 40 2177.12s - 2181.12s | hours and the AI was able to solve all of them in just 30 minutes. 2182.08s - 2187.60s | And if we talk about if the AI can be our second brain or assistant, this is something 2187.60s - 2189.80s | that we need to try together. 2190.08s - 2194.08s | So we will be sharing some stuff in our websites in a couple of weeks. 2194.36s - 2199.28s | So just we can go there to expo.com, you can join the waitlist and we will be sharing 2199.28s - 2202.00s | everything over there and also in


chunk_text:
especially the easy 2150.80s - 2151.76s | ones and the medium ones. 2152.08s - 2156.20s | But depending on the difficulty, we have to improve the performance. 2156.76s - 2162.68s | Then talking about if we can compare human pen testers to AI, as Joel was talking 2162.68s - 2167.52s | before, expert human excel such creativity and are really, really good at hard 2167.52s - 2172.08s | challenges. But yeah, the AI is faster and better. 2172.12s - 2177.12s | We saw in the example that we provided like five pen testers, we gave them like 40 2177.12s - 2181.12s | hours and the AI was able to solve all of them in just 30 minutes. 2182.08s - 2187.60s | And if we talk about if the AI can be our second brain or assistant, this is something 2187.60s - 2189.80s | that we need to try together. 2190.08s - 2194.08s | So we will be sharing some stuff in our websites in a couple of weeks. 2194.36s - 2199.28s | So just we can go there to expo.com, you can join the waitlist and we will be sharing 2199.28s - 2202.00s | everything over there and also in our social media. 2202.00s - 2203.72s | So let's keep an eye on that. 2205.28s - 2208.96s | And finally, we don't want to forget about the team, this is not something that we have 2208.96s - 2212.16s | done ourselves, this is an effort of all the expo team. 2212.56s - 2216.96s | So a big shout out to all of them because we have been working hard these three last 2216.96s - 2221.04s | months. And yeah, this is something that we have done all together. 2222.48s - 2225.40s | And yeah, that's the end of the talk. 2225.48s - 2229.76s | Again, thank you to DEFCON and the Backcountry Village for giving us the opportunity. 2233.50s - 2235.90s | And we have some questions if you want. 2239.30s - 2242.42s | Yes, I'm not sure, I'm not sure if we have a mic. 2242.42s - 2258.04s | So just so so far, everything has been done under control and environment control 2258.04s - 2262.24s | environment. We are not yet using this to do bug bounties. 2262.24s - 2267.28s | We are trying to test this to be used to test how to understand how this could


chunk_text:
our social media. 2202.00s - 2203.72s | So let's keep an eye on that. 2205.28s - 2208.96s | And finally, we don't want to forget about the team, this is not something that we have 2208.96s - 2212.16s | done ourselves, this is an effort of all the expo team. 2212.56s - 2216.96s | So a big shout out to all of them because we have been working hard these three last 2216.96s - 2221.04s | months. And yeah, this is something that we have done all together. 2222.48s - 2225.40s | And yeah, that's the end of the talk. 2225.48s - 2229.76s | Again, thank you to DEFCON and the Backcountry Village for giving us the opportunity. 2233.50s - 2235.90s | And we have some questions if you want. 2239.30s - 2242.42s | Yes, I'm not sure, I'm not sure if we have a mic. 2242.42s - 2258.04s | So just so so far, everything has been done under control and environment control 2258.04s - 2262.24s | environment. We are not yet using this to do bug bounties. 2262.24s - 2267.28s | We are trying to test this to be used to test how to understand how this could be used 2267.28s - 2269.92s | in a bug bounty field and in the security field. 2270.20s - 2273.88s | So so far, there is not a monetary search for this now. 2274.16s - 2276.44s | It's just this what we have shown. 2278.36s - 2288.96s | Yes. Sorry, could you repeat that? 2299.29s - 2303.05s | Yeah, yeah, we have tried probably those are into, if I remember correctly, into 2303.05s - 2305.21s | misconfigurations category. 2305.65s - 2308.53s | But we have tried the headers, manipulation and information. 2309.17s - 2310.73s | We have a few challenges of those. 2310.89s - 2314.17s | I can maybe look for the results after the talk, if you want. 2315.17s - 2336.63s | Yes. So for for the first question, it's depending on how you set the goal, it's very 2336.63s - 2339.83s | persistent. For example, we saw the cross-site scripting that was trying, keeping 2339.83s - 2344.75s | trying, then doing something that we also do kind of human thing is like going and 2344.75s - 2348.87s | looking around to see if can find another hints or something to get into the 2348.87s - 2354.11s | feedback, but


chunk_text:
be used 2267.28s - 2269.92s | in a bug bounty field and in the security field. 2270.20s - 2273.88s | So so far, there is not a monetary search for this now. 2274.16s - 2276.44s | It's just this what we have shown. 2278.36s - 2288.96s | Yes. Sorry, could you repeat that? 2299.29s - 2303.05s | Yeah, yeah, we have tried probably those are into, if I remember correctly, into 2303.05s - 2305.21s | misconfigurations category. 2305.65s - 2308.53s | But we have tried the headers, manipulation and information. 2309.17s - 2310.73s | We have a few challenges of those. 2310.89s - 2314.17s | I can maybe look for the results after the talk, if you want. 2315.17s - 2336.63s | Yes. So for for the first question, it's depending on how you set the goal, it's very 2336.63s - 2339.83s | persistent. For example, we saw the cross-site scripting that was trying, keeping 2339.83s - 2344.75s | trying, then doing something that we also do kind of human thing is like going and 2344.75s - 2348.87s | looking around to see if can find another hints or something to get into the 2348.87s - 2354.11s | feedback, but then goes back to the goal is very persistent into that in terms of 2354.11s - 2357.51s | technical details. It's like you can set the amount of iterations that you want to 2357.51s - 2361.07s | spend so you don't have like an infinite loop of things trying out. 2361.67s - 2363.99s | And the second question was to protect. 2364.15s - 2367.15s | So now is everything run in an isolated environment and protected. 2367.15s - 2372.47s | So we are working on improving that in order to be conscious about what it's doing 2372.47s - 2375.91s | and running. And that's that's also taking into account all the sales force that it 2375.91s - 2377.43s | has to do while testing application. 2378.39s - 2381.67s | So one more, there we go, we're quicker. 2385.24s - 2409.52s | Thank you. Yeah, the thing is that if you're going to play CTF, when you go into hard 2409.52s - 2413.20s | challenges, it's like you have to maybe change too many things together. 2413.44s - 2418.20s | You have to. So probably the AI is being able to detect the first two vectors, but 2418.20s - 2423.04s |


chunk_text:
then goes back to the goal is very persistent into that in terms of 2354.11s - 2357.51s | technical details. It's like you can set the amount of iterations that you want to 2357.51s - 2361.07s | spend so you don't have like an infinite loop of things trying out. 2361.67s - 2363.99s | And the second question was to protect. 2364.15s - 2367.15s | So now is everything run in an isolated environment and protected. 2367.15s - 2372.47s | So we are working on improving that in order to be conscious about what it's doing 2372.47s - 2375.91s | and running. And that's that's also taking into account all the sales force that it 2375.91s - 2377.43s | has to do while testing application. 2378.39s - 2381.67s | So one more, there we go, we're quicker. 2385.24s - 2409.52s | Thank you. Yeah, the thing is that if you're going to play CTF, when you go into hard 2409.52s - 2413.20s | challenges, it's like you have to maybe change too many things together. 2413.44s - 2418.20s | You have to. So probably the AI is being able to detect the first two vectors, but 2418.20s - 2423.04s | then it doesn't go farther and detects the final one that is giving you the flag. 2423.24s - 2428.12s | So that for us is a known solution, even though it found valid endpoints and it 2428.12s - 2429.76s | started exploiting vulnerabilities. 2429.96s - 2433.24s | If it doesn't get the flag, it's a no, no, no resolution for us. 2433.44s - 2439.32s | So probably the creativity and the effort I can put in human and into going to so 2439.32s - 2442.16s | deep, that's what makes the difference for now, at least. 2442.20s - 2443.76s | Yeah. Yeah. 2444.56s - 2446.40s | So I think we have no more time for questions. 2447.68s - 2448.84s | OK, thank you, everyone.


chunk_text:
then it doesn't go farther and detects the final one that is giving you the flag. 2423.24s - 2428.12s | So that for us is a known solution, even though it found valid endpoints and it 2428.12s - 2429.76s | started exploiting vulnerabilities. 2429.96s - 2433.24s | If it doesn't get the flag, it's a no, no, no resolution for us. 2433.44s - 2439.32s | So probably the creativity and the effort I can put in human and into going to so 2439.32s - 2442.16s | deep, that's what makes the difference for now, at least. 2442.20s - 2443.76s | Yeah. Yeah. 2444.56s - 2446.40s | So I think we have no more time for questions. 2447.68s - 2448.84s | OK, thank you, everyone.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=s_w7fxESt-o", "title": "DEF CON 32 - ICS 101 - Bryson Bort, Tom VanNorman", "description": "Introduction to industrial control systems:\n\nWhat is ICS\nPurdue model\nHow ICS is architected\nAttacker view of ICS architecture\nHow to build your own ICS lab\nEquipment\nHow to learn / conduct vulnerability research", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 837, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.88s | This text was transcribed using whisper model: large-v2 I'm Grayson Bort, I'm the founder of Scythe, 2.88s - 6.56s | the founder of Grimm, and the co-founder of the ICS Village. 6.56s - 9.36s | I'm Tommy Norman, co-founder of ICS Village 9.36s - 11.64s | and a senior VP at Grimm. 11.64s - 15.58s | So we run a village down there on industrial control systems 15.58s - 17.60s | so if you wanna get some hands-on experience, 17.60s - 20.20s | which we're gonna just quickly kinda give a high level on, 20.20s - 23.12s | please come on down, we can fuck up shit together. 23.12s - 25.30s | And the best part about it, since it's not production, 25.30s - 27.96s | we all know what it's like to not test in Prague, right? 27.96s - 31.42s | You can poison a fake water supply. 32.56s - 33.40s | Okay. 33.40s - 35.04s | Oh, mics? 35.04s - 36.24s | Do I need a mic? 36.24s - 38.36s | Or is it for recording? 38.36s - 39.20s | Yes. 40.64s - 41.64s | It's fine. 43.60s - 46.28s | All right, so let's talk industrial control systems. 46.28s - 48.68s | Who knows what an industrial control system is? 49.66s - 60.86s | What's an industrial control system? 60.86s - 65.45s | Imagine that, what a good nerd answer. 65.45s - 67.55s | Any computer that's at least 20 years old. 69.65s - 73.61s | Also correct. 73.61s - 76.85s | No, but so why is that important to understand, right? 76.85s - 79.21s | Most of us, it's easy to learn 79.21s - 80.37s | about information technology. 80.37s - 82.45s | This is part of why we wanted to put this talk together 82.45s - 85.65s | is because getting into industrial control systems 85.65s - 87.85s | isn't just something you can walk down to Best Buy 87.85s - 92.85s | and ask for a HMI or a DCS or any of those things. 94.05s


chunk_text:
You can poison a fake water supply. 32.56s - 33.40s | Okay. 33.40s - 35.04s | Oh, mics? 35.04s - 36.24s | Do I need a mic? 36.24s - 38.36s | Or is it for recording? 38.36s - 39.20s | Yes. 40.64s - 41.64s | It's fine. 43.60s - 46.28s | All right, so let's talk industrial control systems. 46.28s - 48.68s | Who knows what an industrial control system is? 49.66s - 60.86s | What's an industrial control system? 60.86s - 65.45s | Imagine that, what a good nerd answer. 65.45s - 67.55s | Any computer that's at least 20 years old. 69.65s - 73.61s | Also correct. 73.61s - 76.85s | No, but so why is that important to understand, right? 76.85s - 79.21s | Most of us, it's easy to learn 79.21s - 80.37s | about information technology. 80.37s - 82.45s | This is part of why we wanted to put this talk together 82.45s - 85.65s | is because getting into industrial control systems 85.65s - 87.85s | isn't just something you can walk down to Best Buy 87.85s - 92.85s | and ask for a HMI or a DCS or any of those things. 94.05s - 94.93s | You're not gonna be able to do it. 94.93s - 97.85s | Now, strangely, you can buy them all on eBay. 97.85s - 99.21s | We're gonna get to that, right? 99.21s - 102.83s | So it's more of this like obfuscated, obtuse discipline 102.83s - 106.17s | that it's like, I'm interested, but how do I get to it? 106.17s - 107.41s | And so that's why, yeah, exactly. 107.41s - 109.01s | That's why we're talking about it today. 109.01s - 111.35s | So that joke, when we go back to industrial control systems 111.35s - 112.77s | already sets the condition, 112.77s - 115.77s | how it's so different than information technology, right? 115.77s - 118.77s | You're trained to buy a phone every two years. 118.77s - 121.33s | Your laptop has a problem, you patch it, 121.33s - 122.69s | you buy a new one, right? 122.69s - 124.13s | It's not expensive, it's easy to do. 124.13s - 125.69s | You're used to doing that. 125.69s - 127.13s | In the industrial control system environment, 127.45s - 129.65s | these things are not built on confidentiality, 129.65s - 130.93s | integrity,


chunk_text:
- 94.93s | You're not gonna be able to do it. 94.93s - 97.85s | Now, strangely, you can buy them all on eBay. 97.85s - 99.21s | We're gonna get to that, right? 99.21s - 102.83s | So it's more of this like obfuscated, obtuse discipline 102.83s - 106.17s | that it's like, I'm interested, but how do I get to it? 106.17s - 107.41s | And so that's why, yeah, exactly. 107.41s - 109.01s | That's why we're talking about it today. 109.01s - 111.35s | So that joke, when we go back to industrial control systems 111.35s - 112.77s | already sets the condition, 112.77s - 115.77s | how it's so different than information technology, right? 115.77s - 118.77s | You're trained to buy a phone every two years. 118.77s - 121.33s | Your laptop has a problem, you patch it, 121.33s - 122.69s | you buy a new one, right? 122.69s - 124.13s | It's not expensive, it's easy to do. 124.13s - 125.69s | You're used to doing that. 125.69s - 127.13s | In the industrial control system environment, 127.45s - 129.65s | these things are not built on confidentiality, 129.65s - 130.93s | integrity, and availability, 130.93s - 134.01s | which are the security principles you've been taught in IT. 134.01s - 137.15s | It's built on resilience and availability. 138.69s - 141.09s | Because what happens when water's not available? 142.31s - 144.57s | You wanna give a nerd answer to that? 144.57s - 145.41s | Bad shit. 146.57s - 148.69s | Bad shit happens, right? 148.69s - 150.79s | So this is a completely different world 150.79s - 152.29s | with a completely different impact. 152.29s - 153.73s | Here's the good news. 153.73s - 155.47s | It's not as hard as it sounds. 156.47s - 158.83s | So we're gonna talk through some of those pieces 158.83s - 160.59s | and we're gonna explain, kind of give you an idea 160.59s - 164.43s | of how the architecture works, how threats work. 164.43s - 166.59s | And then we're gonna talk through some specific examples 166.59s - 168.67s | of how you can start to build your own lab 168.67s - 170.27s | and learn some of those things. 170.27s - 171.63s | And you wanna try? 171.63s - 174.27s | So the one thing that I always talk about 174.27s


chunk_text:
and availability, 130.93s - 134.01s | which are the security principles you've been taught in IT. 134.01s - 137.15s | It's built on resilience and availability. 138.69s - 141.09s | Because what happens when water's not available? 142.31s - 144.57s | You wanna give a nerd answer to that? 144.57s - 145.41s | Bad shit. 146.57s - 148.69s | Bad shit happens, right? 148.69s - 150.79s | So this is a completely different world 150.79s - 152.29s | with a completely different impact. 152.29s - 153.73s | Here's the good news. 153.73s - 155.47s | It's not as hard as it sounds. 156.47s - 158.83s | So we're gonna talk through some of those pieces 158.83s - 160.59s | and we're gonna explain, kind of give you an idea 160.59s - 164.43s | of how the architecture works, how threats work. 164.43s - 166.59s | And then we're gonna talk through some specific examples 166.59s - 168.67s | of how you can start to build your own lab 168.67s - 170.27s | and learn some of those things. 170.27s - 171.63s | And you wanna try? 171.63s - 174.27s | So the one thing that I always talk about 174.27s - 175.67s | with industrial control systems, 175.67s - 179.03s | why or how are they different than IT, 179.03s - 181.35s | other than being really old? 181.35s - 182.47s | Health, life, and safety. 182.47s - 183.55s | Those are the three things, right? 183.67s - 186.19s | Your email goes out, what happens? 186.19s - 187.87s | You have a quiet day, right? 187.87s - 190.91s | Your website goes down, you lose money, it's a bad day. 190.91s - 193.77s | Amazon, Delta we saw, bad day. 195.25s - 198.07s | Those controllers go down and your grid turns off 198.07s - 200.37s | or your water plant turns off. 200.37s - 202.35s | That's health, life, and safety. 202.35s - 205.91s | So those are the three things that I always go back to 205.91s - 207.71s | when we talk about control systems. 207.71s - 209.53s | IT, you can turn that stuff off. 209.53s - 211.51s | You'll have a bad day, you'll have a quiet day. 211.51s - 212.43s | You're not gonna kill people. 212.43s - 213.59s | You're not gonna pollute the environment. 213.59s - 217.59s | You're not gonna


chunk_text:
- 175.67s | with industrial control systems, 175.67s - 179.03s | why or how are they different than IT, 179.03s - 181.35s | other than being really old? 181.35s - 182.47s | Health, life, and safety. 182.47s - 183.55s | Those are the three things, right? 183.67s - 186.19s | Your email goes out, what happens? 186.19s - 187.87s | You have a quiet day, right? 187.87s - 190.91s | Your website goes down, you lose money, it's a bad day. 190.91s - 193.77s | Amazon, Delta we saw, bad day. 195.25s - 198.07s | Those controllers go down and your grid turns off 198.07s - 200.37s | or your water plant turns off. 200.37s - 202.35s | That's health, life, and safety. 202.35s - 205.91s | So those are the three things that I always go back to 205.91s - 207.71s | when we talk about control systems. 207.71s - 209.53s | IT, you can turn that stuff off. 209.53s - 211.51s | You'll have a bad day, you'll have a quiet day. 211.51s - 212.43s | You're not gonna kill people. 212.43s - 213.59s | You're not gonna pollute the environment. 213.59s - 217.59s | You're not gonna destroy things and hurt people. 217.59s - 218.75s | Way to bring us down, man. 218.75s - 220.27s | I know, how about it? 220.27s - 222.27s | You made me run all the way downstairs up to here 222.27s - 223.27s | and we were lost. 224.39s - 225.79s | We were lost for five minutes. 225.79s - 228.83s | We could not figure out where this place was. 228.83s - 230.03s | So here's the good news. 230.03s - 231.43s | This is why it's easier. 231.43s - 232.95s | Besides the fact that everything is older 232.95s - 234.27s | and actually much simpler. 235.51s - 238.52s | Forgot my point. 240.16s - 242.96s | Been here seven days and blackout was really long, okay? 243.84s - 246.88s | Is there's a physical effect, right? 246.88s - 249.12s | Hey, I pop shell, I have an interpreter session. 249.12s - 251.40s | Okay, hey, data got lost. 251.40s - 252.24s | What does that mean? 252.24s - 253.84s | How do I feel that? 253.84s - 255.08s | With industrial control systems, 255.08s - 257.92s | there is a physical change in the world, right? 257.92s -


chunk_text:
destroy things and hurt people. 217.59s - 218.75s | Way to bring us down, man. 218.75s - 220.27s | I know, how about it? 220.27s - 222.27s | You made me run all the way downstairs up to here 222.27s - 223.27s | and we were lost. 224.39s - 225.79s | We were lost for five minutes. 225.79s - 228.83s | We could not figure out where this place was. 228.83s - 230.03s | So here's the good news. 230.03s - 231.43s | This is why it's easier. 231.43s - 232.95s | Besides the fact that everything is older 232.95s - 234.27s | and actually much simpler. 235.51s - 238.52s | Forgot my point. 240.16s - 242.96s | Been here seven days and blackout was really long, okay? 243.84s - 246.88s | Is there's a physical effect, right? 246.88s - 249.12s | Hey, I pop shell, I have an interpreter session. 249.12s - 251.40s | Okay, hey, data got lost. 251.40s - 252.24s | What does that mean? 252.24s - 253.84s | How do I feel that? 253.84s - 255.08s | With industrial control systems, 255.08s - 257.92s | there is a physical change in the world, right? 257.92s - 261.48s | The lights go off, the light bulb goes on, right? 261.48s - 264.44s | We're not popping calc.exe in a Windows box. 264.44s - 266.68s | You're actually seeing something change. 266.68s - 269.12s | So there's a lot more of that physical feedback loop 269.12s - 269.96s | on the learning. 269.96s - 270.80s | So how is it set up? 270.80s - 272.40s | Who's heard of the Purdue model? 273.28s - 274.32s | We've got some hands, all right. 274.32s - 275.24s | We've got ringers. 276.96s - 278.16s | What's the Purdue model? 280.52s - 281.56s | There are no experts. 293.52s - 295.20s | Data segmentation, data flow. 299.68s - 302.56s | So I meant the words that are the correct answer. 303.52s - 304.36s | No, you got it. 304.36s - 306.64s | So it is a nominal enterprise architecture 306.64s - 308.32s | and it breaks down five levels. 308.32s - 310.20s | The first you all know, IT. 310.20s - 311.84s | And IT is just one box. 311.84s - 313.64s | And then there is always, 313.64s - 316.04s | I want you to all repeat with me, an


chunk_text:
261.48s | The lights go off, the light bulb goes on, right? 261.48s - 264.44s | We're not popping calc.exe in a Windows box. 264.44s - 266.68s | You're actually seeing something change. 266.68s - 269.12s | So there's a lot more of that physical feedback loop 269.12s - 269.96s | on the learning. 269.96s - 270.80s | So how is it set up? 270.80s - 272.40s | Who's heard of the Purdue model? 273.28s - 274.32s | We've got some hands, all right. 274.32s - 275.24s | We've got ringers. 276.96s - 278.16s | What's the Purdue model? 280.52s - 281.56s | There are no experts. 293.52s - 295.20s | Data segmentation, data flow. 299.68s - 302.56s | So I meant the words that are the correct answer. 303.52s - 304.36s | No, you got it. 304.36s - 306.64s | So it is a nominal enterprise architecture 306.64s - 308.32s | and it breaks down five levels. 308.32s - 310.20s | The first you all know, IT. 310.20s - 311.84s | And IT is just one box. 311.84s - 313.64s | And then there is always, 313.64s - 316.04s | I want you to all repeat with me, an air gap. 317.40s - 319.44s | It's not an air gap. 319.44s - 320.52s | Is not an air gap. 321.64s - 324.32s | Your IT will always talk to your OT. 324.32s - 325.72s | And there's a lot of reasons for that. 325.72s - 327.48s | I've always had, I always love it when there's some nerd 327.48s - 328.60s | who's like, well, actually, 328.60s - 330.84s | have you ever like been in a nuclear power plant? 330.84s - 332.48s | I'm like, yep, that air gap is never pure. 333.48s - 334.96s | There's a reason, okay. 334.96s - 336.64s | So let's just understand that. 336.64s - 339.44s | Next level up is your DMZ. 339.44s - 341.48s | So you need shared service functions 341.48s - 344.32s | because there's still some level of IT functionality. 344.32s - 345.72s | There's centralized management 345.72s - 347.64s | that we need to be running these things. 347.64s - 349.92s | So that's your high level industrial control systems. 349.92s - 352.28s | Then we start breaking down into what are called, 352.28s - 353.88s | specific control zones. 353.88s - 356.12s | And so


chunk_text:
air gap. 317.40s - 319.44s | It's not an air gap. 319.44s - 320.52s | Is not an air gap. 321.64s - 324.32s | Your IT will always talk to your OT. 324.32s - 325.72s | And there's a lot of reasons for that. 325.72s - 327.48s | I've always had, I always love it when there's some nerd 327.48s - 328.60s | who's like, well, actually, 328.60s - 330.84s | have you ever like been in a nuclear power plant? 330.84s - 332.48s | I'm like, yep, that air gap is never pure. 333.48s - 334.96s | There's a reason, okay. 334.96s - 336.64s | So let's just understand that. 336.64s - 339.44s | Next level up is your DMZ. 339.44s - 341.48s | So you need shared service functions 341.48s - 344.32s | because there's still some level of IT functionality. 344.32s - 345.72s | There's centralized management 345.72s - 347.64s | that we need to be running these things. 347.64s - 349.92s | So that's your high level industrial control systems. 349.92s - 352.28s | Then we start breaking down into what are called, 352.28s - 353.88s | specific control zones. 353.88s - 356.12s | And so that's basically two, one, zero. 356.12s - 357.80s | And that's where we have this combination 357.80s - 359.80s | of engineering workstations, 359.80s - 361.44s | programmable logic controllers, 361.88s - 365.16s | the things that are actually making a process do a thing. 365.16s - 366.84s | Again, going back to my original point, 366.84s - 368.84s | that process has an output. 368.84s - 370.52s | That's the cool part about this. 370.52s - 373.68s | Those subsystems are outputting something. 373.68s - 375.76s | And so the purpose of the Purdue model 375.76s - 377.68s | is understanding that segmentation 377.68s - 379.28s | and then learning how to design 379.28s - 381.56s | what are called control zones and conduits. 381.56s - 382.96s | How do I create segmentation 382.96s - 385.92s | so that if there's an issue on this output over here 385.92s - 387.80s | that is spitting out this widget, 387.80s - 389.72s | it doesn't impact something over here. 390.52s - 392.16s | And then the conduits are my way 392.16s - 394.04s | of driving still the information, 394.04s - 396.12s | the data flow that I need to


chunk_text:
that's basically two, one, zero. 356.12s - 357.80s | And that's where we have this combination 357.80s - 359.80s | of engineering workstations, 359.80s - 361.44s | programmable logic controllers, 361.88s - 365.16s | the things that are actually making a process do a thing. 365.16s - 366.84s | Again, going back to my original point, 366.84s - 368.84s | that process has an output. 368.84s - 370.52s | That's the cool part about this. 370.52s - 373.68s | Those subsystems are outputting something. 373.68s - 375.76s | And so the purpose of the Purdue model 375.76s - 377.68s | is understanding that segmentation 377.68s - 379.28s | and then learning how to design 379.28s - 381.56s | what are called control zones and conduits. 381.56s - 382.96s | How do I create segmentation 382.96s - 385.92s | so that if there's an issue on this output over here 385.92s - 387.80s | that is spitting out this widget, 387.80s - 389.72s | it doesn't impact something over here. 390.52s - 392.16s | And then the conduits are my way 392.16s - 394.04s | of driving still the information, 394.04s - 396.12s | the data flow that I need to have between them. 396.12s - 397.88s | Now, here's the problem. 397.88s - 400.12s | I just said five levels of something. 400.12s - 404.29s | Doesn't that just feel like defense in depth? 404.29s - 405.57s | Yes. 405.57s - 406.41s | Yes. 408.13s - 410.41s | You were shaking no, because you knew where I was going. 410.41s - 412.17s | The correct answer is in fact, yes. 412.17s - 414.85s | There are no trick questions, just dumb answers. 417.57s - 420.82s | Glad you all get my sense of humor. 421.14s - 423.18s | So the point is that all collapses 423.18s - 425.94s | into what we really see from the threat perspective. 425.94s - 427.78s | So there's basically two ways. 427.78s - 429.38s | Well, there's actually five ways in, 429.38s - 431.74s | but we're gonna simplify it to the two common. 431.74s - 433.30s | The one which you probably hear the most 433.30s - 435.42s | and gets the most press play is, 435.42s - 437.90s | oh my gosh, my operational technology devices 437.90s - 439.58s | are directly connected to the internet. 439.58s - 441.62s | Look at


chunk_text:
have between them. 396.12s - 397.88s | Now, here's the problem. 397.88s - 400.12s | I just said five levels of something. 400.12s - 404.29s | Doesn't that just feel like defense in depth? 404.29s - 405.57s | Yes. 405.57s - 406.41s | Yes. 408.13s - 410.41s | You were shaking no, because you knew where I was going. 410.41s - 412.17s | The correct answer is in fact, yes. 412.17s - 414.85s | There are no trick questions, just dumb answers. 417.57s - 420.82s | Glad you all get my sense of humor. 421.14s - 423.18s | So the point is that all collapses 423.18s - 425.94s | into what we really see from the threat perspective. 425.94s - 427.78s | So there's basically two ways. 427.78s - 429.38s | Well, there's actually five ways in, 429.38s - 431.74s | but we're gonna simplify it to the two common. 431.74s - 433.30s | The one which you probably hear the most 433.30s - 435.42s | and gets the most press play is, 435.42s - 437.90s | oh my gosh, my operational technology devices 437.90s - 439.58s | are directly connected to the internet. 439.58s - 441.62s | Look at what Shodan or Census turned up. 444.14s - 445.78s | Yeah, it happens, 445.78s - 448.26s | but it's not the most common access vector. 448.26s - 450.50s | The most common access vector is what you see 451.18s - 453.58s | in most of your daily enterprise IT lives, 453.58s - 457.42s | because IT is the big squishy thing on the internet. 457.42s - 459.26s | That's its entire purpose. 459.26s - 461.26s | And I'm not gonna guess you're all model employees. 461.26s - 463.26s | So you're not just surfing the web 463.26s - 468.34s | instead of doing your jobs. 468.34s - 469.18s | Take the credit. 469.18s - 472.14s | That's about the nicest thing I'm gonna say to you all day. 472.14s - 474.30s | We can go back to Dr. Doom here if you want. 477.66s - 480.22s | So all of those tactics that you see in IT 480.22s - 482.42s | are the same ones that we have to worry about. 482.46s - 484.50s | They come in, they pivot, they move, 484.50s - 486.34s | and again, because an air gap is not an air gap 486.34s - 488.86s


chunk_text:
what Shodan or Census turned up. 444.14s - 445.78s | Yeah, it happens, 445.78s - 448.26s | but it's not the most common access vector. 448.26s - 450.50s | The most common access vector is what you see 451.18s - 453.58s | in most of your daily enterprise IT lives, 453.58s - 457.42s | because IT is the big squishy thing on the internet. 457.42s - 459.26s | That's its entire purpose. 459.26s - 461.26s | And I'm not gonna guess you're all model employees. 461.26s - 463.26s | So you're not just surfing the web 463.26s - 468.34s | instead of doing your jobs. 468.34s - 469.18s | Take the credit. 469.18s - 472.14s | That's about the nicest thing I'm gonna say to you all day. 472.14s - 474.30s | We can go back to Dr. Doom here if you want. 477.66s - 480.22s | So all of those tactics that you see in IT 480.22s - 482.42s | are the same ones that we have to worry about. 482.46s - 484.50s | They come in, they pivot, they move, 484.50s - 486.34s | and again, because an air gap is not an air gap 486.34s - 488.86s | is not an air gap, I cross over. 488.86s - 491.46s | Now, we still have three to four levels, 491.46s - 493.62s | actually four levels on that side, 493.62s - 495.22s | but here's where they all collapse. 495.22s - 498.30s | So you're all aware of the gloom and doom cyber weapons. 498.30s - 499.94s | We know about Indestroyer, Indestroyer 2, 499.94s - 502.42s | we've seen the Russian military using in Ukraine. 502.42s - 505.02s | That's not the thing we have to worry about most. 505.02s - 507.54s | The same way that PowerShell pretty much defines 507.54s - 513.92s | what happens in IT, same thing in OT. 513.92s - 515.00s | It's the living off the land, 515.00s - 517.60s | taking over those high-level industrial control systems, 517.60s - 520.24s | they tell everything else what to do. 520.24s - 522.44s | So now we've anchored how this works, 522.44s - 523.76s | what we got to worry about. 523.76s - 526.24s | Now let's talk about how we start to teach ourselves. 527.36s - 528.20s | Labs. 528.20s - 532.44s | So if anybody has not been in the


chunk_text:
| is not an air gap, I cross over. 488.86s - 491.46s | Now, we still have three to four levels, 491.46s - 493.62s | actually four levels on that side, 493.62s - 495.22s | but here's where they all collapse. 495.22s - 498.30s | So you're all aware of the gloom and doom cyber weapons. 498.30s - 499.94s | We know about Indestroyer, Indestroyer 2, 499.94s - 502.42s | we've seen the Russian military using in Ukraine. 502.42s - 505.02s | That's not the thing we have to worry about most. 505.02s - 507.54s | The same way that PowerShell pretty much defines 507.54s - 513.92s | what happens in IT, same thing in OT. 513.92s - 515.00s | It's the living off the land, 515.00s - 517.60s | taking over those high-level industrial control systems, 517.60s - 520.24s | they tell everything else what to do. 520.24s - 522.44s | So now we've anchored how this works, 522.44s - 523.76s | what we got to worry about. 523.76s - 526.24s | Now let's talk about how we start to teach ourselves. 527.36s - 528.20s | Labs. 528.20s - 532.44s | So if anybody has not been in the ISS Village downstairs, 532.44s - 534.28s | back in the corner, please stop by. 534.28s - 537.48s | We'll show you what we have, our hands on demos. 537.48s - 538.80s | Yes, we know where that is. 538.80s - 540.72s | And it's far, but not that far. 541.64s - 543.44s | It's not in another building, right? 543.44s - 546.24s | So how do we build these systems? 546.24s - 548.88s | How do we build in an environment where we can train? 548.88s - 551.52s | We can see if our patches work. 551.52s - 552.64s | That's a really important one. 552.64s - 554.32s | Never patch production, right? 556.12s - 557.88s | Live anyway, you want to patch production, 557.88s - 560.32s | but you want to test those patches before you push it out 560.32s - 562.68s | or things happen. 562.68s - 563.64s | How do we do that? 563.64s - 567.88s | Well, with ICS Village and my day job and all that, 567.88s - 569.16s | we build these systems out. 569.16s - 571.36s | So what we've been doing, 572.28s - 574.08s | we don't use virtualized systems, 574.08s -


chunk_text:
ISS Village downstairs, 532.44s - 534.28s | back in the corner, please stop by. 534.28s - 537.48s | We'll show you what we have, our hands on demos. 537.48s - 538.80s | Yes, we know where that is. 538.80s - 540.72s | And it's far, but not that far. 541.64s - 543.44s | It's not in another building, right? 543.44s - 546.24s | So how do we build these systems? 546.24s - 548.88s | How do we build in an environment where we can train? 548.88s - 551.52s | We can see if our patches work. 551.52s - 552.64s | That's a really important one. 552.64s - 554.32s | Never patch production, right? 556.12s - 557.88s | Live anyway, you want to patch production, 557.88s - 560.32s | but you want to test those patches before you push it out 560.32s - 562.68s | or things happen. 562.68s - 563.64s | How do we do that? 563.64s - 567.88s | Well, with ICS Village and my day job and all that, 567.88s - 569.16s | we build these systems out. 569.16s - 571.36s | So what we've been doing, 572.28s - 574.08s | we don't use virtualized systems, 574.08s - 578.16s | but we'll use virtualized systems when it should be used, 578.16s - 579.92s | such as HMIs and things like that, right? 579.92s - 580.76s | They're all virtualized. 580.76s - 583.00s | They're just window assets. 583.00s - 586.20s | When we get down to controllers, 587.16s - 589.08s | we're using the real ones, right? 589.08s - 590.24s | We're not using Raspberry Pi. 590.24s - 592.24s | Sure, you can use OpenPLC, you can do all these other ones. 592.24s - 594.40s | But the reason why we're not doing that downstairs 594.40s - 598.48s | in ICS Village is they just don't work the same. 598.48s - 601.36s | So when you go out and you want to learn 601.36s - 602.28s | how these systems work, 602.28s - 603.88s | whether you're interested in the control system 603.88s - 604.72s | to get a job in it, 604.72s - 608.32s | or you're a working practitioner or professional now in it, 608.32s - 609.56s | how do you do this? 610.52s - 611.56s | We source stuff from eBay. 611.56s - 613.04s | We source stuff from our vendors. 613.04s - 615.92s |


chunk_text:
578.16s | but we'll use virtualized systems when it should be used, 578.16s - 579.92s | such as HMIs and things like that, right? 579.92s - 580.76s | They're all virtualized. 580.76s - 583.00s | They're just window assets. 583.00s - 586.20s | When we get down to controllers, 587.16s - 589.08s | we're using the real ones, right? 589.08s - 590.24s | We're not using Raspberry Pi. 590.24s - 592.24s | Sure, you can use OpenPLC, you can do all these other ones. 592.24s - 594.40s | But the reason why we're not doing that downstairs 594.40s - 598.48s | in ICS Village is they just don't work the same. 598.48s - 601.36s | So when you go out and you want to learn 601.36s - 602.28s | how these systems work, 602.28s - 603.88s | whether you're interested in the control system 603.88s - 604.72s | to get a job in it, 604.72s - 608.32s | or you're a working practitioner or professional now in it, 608.32s - 609.56s | how do you do this? 610.52s - 611.56s | We source stuff from eBay. 611.56s - 613.04s | We source stuff from our vendors. 613.04s - 615.92s | We get stuff donated to us, but- 615.92s - 617.24s | How can I buy something from eBay? 617.24s - 619.04s | How would I make that work for home? 621.08s - 624.32s | So I wouldn't recommend that, actually. 627.28s - 629.04s | The problem is that we run into, 629.04s - 630.48s | you buy that thing from eBay. 630.48s - 631.64s | Well, great, now you need a license. 631.64s - 632.48s | Now you need a key. 632.48s - 633.32s | Now you need that thing. 633.32s - 634.16s | You need that thing. 634.16s - 635.08s | You need that cable, all that stuff. 635.08s - 636.60s | That stuff's not trivial. 636.60s - 639.00s | Once you're using it, yes, now you understand. 639.00s - 641.96s | But for somebody to take that thing from, 641.96s - 643.44s | you know, that Allen Bradley controller 643.44s - 646.84s | from eBay that you bought for 150 bucks, 646.84s - 647.96s | well, where's the cable? 647.96s - 648.84s | Where's the license? 648.84s - 649.68s | Where's that? 649.68s - 651.64s | So that gets quite difficult. 651.64s - 653.40s | Come volunteer for


chunk_text:
We get stuff donated to us, but- 615.92s - 617.24s | How can I buy something from eBay? 617.24s - 619.04s | How would I make that work for home? 621.08s - 624.32s | So I wouldn't recommend that, actually. 627.28s - 629.04s | The problem is that we run into, 629.04s - 630.48s | you buy that thing from eBay. 630.48s - 631.64s | Well, great, now you need a license. 631.64s - 632.48s | Now you need a key. 632.48s - 633.32s | Now you need that thing. 633.32s - 634.16s | You need that thing. 634.16s - 635.08s | You need that cable, all that stuff. 635.08s - 636.60s | That stuff's not trivial. 636.60s - 639.00s | Once you're using it, yes, now you understand. 639.00s - 641.96s | But for somebody to take that thing from, 641.96s - 643.44s | you know, that Allen Bradley controller 643.44s - 646.84s | from eBay that you bought for 150 bucks, 646.84s - 647.96s | well, where's the cable? 647.96s - 648.84s | Where's the license? 648.84s - 649.68s | Where's that? 649.68s - 651.64s | So that gets quite difficult. 651.64s - 653.40s | Come volunteer for ICS Village. 653.40s - 655.60s | We'll show you how to do that stuff. 655.60s - 658.48s | We can get you connected with different universities, 658.80s - 661.36s | colleges, learning institutions. 661.36s - 663.00s | I'll show you how to do that. 664.24s - 667.56s | One of the things that we're constantly saying 667.56s - 668.96s | to people when they come up, they're saying, 668.96s - 671.00s | hey, where do I start? 671.00s - 671.92s | What do I do? 673.52s - 675.04s | We're looking at authentication. 675.04s - 676.72s | We're looking at segmentation. 676.72s - 679.36s | We're looking at knowing what's on your network. 679.36s - 681.52s | Well, what does that even mean? 681.52s - 683.80s | So, you know, whether you're gonna walk down 683.80s - 686.56s | your plant floor, whether you're gonna take PCAPs, 686.56s - 687.48s | whether you're gonna do something, 687.48s - 688.36s | know what's on your network. 689.24s - 691.20s | Your asset detection, authentication. 691.20s - 693.40s | Don't leave everything admin, admin. 693.40s - 696.40s | However, that's a legitimate thing now. 696.40s - 699.32s | You go into that,


chunk_text:
ICS Village. 653.40s - 655.60s | We'll show you how to do that stuff. 655.60s - 658.48s | We can get you connected with different universities, 658.80s - 661.36s | colleges, learning institutions. 661.36s - 663.00s | I'll show you how to do that. 664.24s - 667.56s | One of the things that we're constantly saying 667.56s - 668.96s | to people when they come up, they're saying, 668.96s - 671.00s | hey, where do I start? 671.00s - 671.92s | What do I do? 673.52s - 675.04s | We're looking at authentication. 675.04s - 676.72s | We're looking at segmentation. 676.72s - 679.36s | We're looking at knowing what's on your network. 679.36s - 681.52s | Well, what does that even mean? 681.52s - 683.80s | So, you know, whether you're gonna walk down 683.80s - 686.56s | your plant floor, whether you're gonna take PCAPs, 686.56s - 687.48s | whether you're gonna do something, 687.48s - 688.36s | know what's on your network. 689.24s - 691.20s | Your asset detection, authentication. 691.20s - 693.40s | Don't leave everything admin, admin. 693.40s - 696.40s | However, that's a legitimate thing now. 696.40s - 699.32s | You go into that, you know, nuclear plant 699.32s - 701.12s | like Price just talked about here. 701.12s - 702.44s | Well, you have guard gates and guns 702.44s - 703.80s | and you're seven layers down. 703.80s - 704.92s | Does it really matter at that point 704.92s - 706.60s | if your sticky note has that? 707.56s - 709.12s | I don't think it does. 709.12s - 712.68s | Because if your adversary's in there that far anyway, 712.68s - 714.16s | you're done. 715.08s - 717.84s | But what you need is to be able to get into that HMI 717.84s - 719.24s | or get into that thing really quick 719.24s - 721.12s | to turn that thing off or on or whatever. 721.12s - 723.28s | So it's a balance, right? 723.28s - 725.32s | If you have a gateway device, 725.32s - 727.72s | no, don't use admin, admin, that's really bad. 727.72s - 729.68s | Complicated passwords. 729.68s - 731.52s | And then segmentation. 731.52s - 734.80s | Now, those are the three things that we come back 734.80s - 736.40s | and say, hey, you do those three things, 736.40s - 738.52s | you're going


chunk_text:
you know, nuclear plant 699.32s - 701.12s | like Price just talked about here. 701.12s - 702.44s | Well, you have guard gates and guns 702.44s - 703.80s | and you're seven layers down. 703.80s - 704.92s | Does it really matter at that point 704.92s - 706.60s | if your sticky note has that? 707.56s - 709.12s | I don't think it does. 709.12s - 712.68s | Because if your adversary's in there that far anyway, 712.68s - 714.16s | you're done. 715.08s - 717.84s | But what you need is to be able to get into that HMI 717.84s - 719.24s | or get into that thing really quick 719.24s - 721.12s | to turn that thing off or on or whatever. 721.12s - 723.28s | So it's a balance, right? 723.28s - 725.32s | If you have a gateway device, 725.32s - 727.72s | no, don't use admin, admin, that's really bad. 727.72s - 729.68s | Complicated passwords. 729.68s - 731.52s | And then segmentation. 731.52s - 734.80s | Now, those are the three things that we come back 734.80s - 736.40s | and say, hey, you do those three things, 736.40s - 738.52s | you're going to make your life 738.52s - 741.56s | or your network so much more secure. 741.56s - 742.88s | Do we have a lot of other things off that? 742.88s - 744.20s | Yes, but those are the three things 744.20s - 745.36s | that we keep on going back. 745.36s - 747.12s | So how does that tie in with labs? 747.16s - 748.28s | Well, how do you patch something? 748.28s - 749.52s | How do you go and change that password? 749.52s - 752.16s | How do you update that X509 server 752.16s - 753.76s | or whatever cert you have? 753.76s - 755.00s | That's not trivial. 755.00s - 758.40s | If you're doing it, okay, that works. 758.40s - 760.40s | But now, come back three years later 760.40s - 761.36s | and learn how those certs work 761.36s - 762.64s | and how you updated that. 762.64s - 764.92s | Guarantee, unless you're doing that on a day-by-day, 764.92s - 766.76s | you're not going to figure it out. 766.76s - 769.40s | But now it's running a real production device. 769.40s - 773.08s | So it's, I already hear they're yelling at us


chunk_text:
to make your life 738.52s - 741.56s | or your network so much more secure. 741.56s - 742.88s | Do we have a lot of other things off that? 742.88s - 744.20s | Yes, but those are the three things 744.20s - 745.36s | that we keep on going back. 745.36s - 747.12s | So how does that tie in with labs? 747.16s - 748.28s | Well, how do you patch something? 748.28s - 749.52s | How do you go and change that password? 749.52s - 752.16s | How do you update that X509 server 752.16s - 753.76s | or whatever cert you have? 753.76s - 755.00s | That's not trivial. 755.00s - 758.40s | If you're doing it, okay, that works. 758.40s - 760.40s | But now, come back three years later 760.40s - 761.36s | and learn how those certs work 761.36s - 762.64s | and how you updated that. 762.64s - 764.92s | Guarantee, unless you're doing that on a day-by-day, 764.92s - 766.76s | you're not going to figure it out. 766.76s - 769.40s | But now it's running a real production device. 769.40s - 773.08s | So it's, I already hear they're yelling at us 773.08s - 775.08s | to get off the stage now. 775.08s - 777.08s | Anyway, we came late. 777.92s - 779.16s | We have a lot of stuff to talk about. 779.16s - 781.92s | Come downstairs, ICS Village. 781.92s - 784.00s | We have a lot of really great volunteers down there. 784.00s - 786.20s | Bryce and I are down there. 786.20s - 787.36s | We'll show you what's going on. 787.36s - 788.88s | We will do all that stuff. 788.88s - 789.92s | He's yelling at me again. 789.92s - 791.44s | The second time he's come in, 791.44s - 793.40s | that guy in the red shirt, 793.40s - 795.36s | yelling at the guys that were late. 795.36s - 796.44s | Thank you, everyone. 796.44s - 801.04s | Our apologies for coming up here and doing this. 801.04s - 802.96s | Yes, yes, yes. 802.96s - 811.65s | Ashley, yes. 811.65s - 813.45s | So it's not what we do. 813.49s - 816.53s | We go off of usually like SANS critical controls. 816.53s - 818.25s | We go off of industry things 818.25s - 819.45s | because why? 819.45s - 820.29s | They


chunk_text:
773.08s - 775.08s | to get off the stage now. 775.08s - 777.08s | Anyway, we came late. 777.92s - 779.16s | We have a lot of stuff to talk about. 779.16s - 781.92s | Come downstairs, ICS Village. 781.92s - 784.00s | We have a lot of really great volunteers down there. 784.00s - 786.20s | Bryce and I are down there. 786.20s - 787.36s | We'll show you what's going on. 787.36s - 788.88s | We will do all that stuff. 788.88s - 789.92s | He's yelling at me again. 789.92s - 791.44s | The second time he's come in, 791.44s - 793.40s | that guy in the red shirt, 793.40s - 795.36s | yelling at the guys that were late. 795.36s - 796.44s | Thank you, everyone. 796.44s - 801.04s | Our apologies for coming up here and doing this. 801.04s - 802.96s | Yes, yes, yes. 802.96s - 811.65s | Ashley, yes. 811.65s - 813.45s | So it's not what we do. 813.49s - 816.53s | We go off of usually like SANS critical controls. 816.53s - 818.25s | We go off of industry things 818.25s - 819.45s | because why? 819.45s - 820.29s | They work. 820.29s - 821.13s | They're right. 821.13s - 830.40s | That's what you need. 830.40s - 831.60s | Yep, we're happy to do that. 831.60s - 832.44s | We're done. 832.44s - 833.28s | We're done. 833.28s - 834.12s | Thank you.


chunk_text:
work. 820.29s - 821.13s | They're right. 821.13s - 830.40s | That's what you need. 830.40s - 831.60s | Yep, we're happy to do that. 831.60s - 832.44s | We're done. 832.44s - 833.28s | We're done. 833.28s - 834.12s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=wSVdfOn737o", "title": "DEF CON 32 - GPS spoofing it's about time, not just position - Ken Munro", "description": "Talking to pilots and operators, an important aspect of GPS spoofing and jamming is being missed from the narrative in the media. We know about position spoofing, that's a given. What doesn't appear to be getting much attention is the effect of time spoofing.\n\nThe most significant of these is an incident where time was spoofed a significant period into the future. This caused all digital certificates on board an aircraft to become invalid and caused all electronic communications to fail. As GPS clocks have protection against time being rolled backwards, but not forward, the aircraft was grounded for several weeks for systems to be reflashed and the clocks to be reset,\n\nCoarse time spoofing could therefore ground entire fleets. We'll discuss this and potential mitigations. If time allows, we could touch on conventional RF navaids and their exposure to similar attacks.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1324, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 8.80s | This text was transcribed using whisper model: large-v2 Well, good afternoon. Now, I'm here to talk about time, time particularly in aviation. 9.52s - 14.16s | Now, we're going to be talking about GNSS, GPS, of course, which you know, 14.16s - 19.12s | GPS is a subset of GNSS. And forgive me because I switched between the two terms 19.12s - 22.80s | a few times during the presentation. So let's use them interchangeably for the moment. 22.80s - 29.20s | Now, a little bit about me and the organisation I work for. We are red teamers and pen testers, 29.20s - 34.80s | but we spend a lot of time working in aviation. During COVID, a lot of airplanes were laid up 34.80s - 39.20s | and we got to do some vanilla research working on retired airplanes, which is great fun. 39.76s - 43.60s | You learn a great deal very quickly about some very new and very old systems too. 44.32s - 48.96s | Along the way, we've advised several airlines, several manufacturers. We're on very good terms 48.96s - 56.00s | with Boeing. And we've had the great opportunity to do some vanilla research on systems such as 56.00s - 61.44s | collision avoidance systems, instrument landing systems, and also electronic flight bags, 61.44s - 70.08s | which I gave


chunk_text:
| Now, we're going to be talking about GNSS, GPS, of course, which you know, 14.16s - 19.12s | GPS is a subset of GNSS. And forgive me because I switched between the two terms 19.12s - 22.80s | a few times during the presentation. So let's use them interchangeably for the moment. 22.80s - 29.20s | Now, a little bit about me and the organisation I work for. We are red teamers and pen testers, 29.20s - 34.80s | but we spend a lot of time working in aviation. During COVID, a lot of airplanes were laid up 34.80s - 39.20s | and we got to do some vanilla research working on retired airplanes, which is great fun. 39.76s - 43.60s | You learn a great deal very quickly about some very new and very old systems too. 44.32s - 48.96s | Along the way, we've advised several airlines, several manufacturers. We're on very good terms 48.96s - 56.00s | with Boeing. And we've had the great opportunity to do some vanilla research on systems such as 56.00s - 61.44s | collision avoidance systems, instrument landing systems, and also electronic flight bags, 61.44s - 70.08s | which I gave a talk about yesterday. Anyway, who am I? Well, I'm a really bad pilot. I have had 70.08s - 74.88s | so many bad incidents happen to me. I've landed at the wrong airport by mistake once. That was 74.88s - 79.36s | embarrassing. I had my engine quit on me once. Fortunately, it happened just after I took off, 79.36s - 84.48s | the runway was long, we were fine. I've had my undercarriage hang up twice. That was a bit 84.48s - 88.88s | awkward. And I've very nearly crashed into three other airplanes. So whatever you do, don't fly 88.88s - 93.44s | with me. It's really bad. Navigationally, I also accidentally trolled air traffic control. I was 93.44s - 97.52s | there when I was actually there. That caused a bit of a consternation as well. But hey, 98.64s - 104.48s | fortunately for you, I never made it to commercial. I studied, but I never made it 104.48s - 110.08s | to the airlines, which was a bit of a shame. So instead, back in 2002, I founded a pen testing 110.08s - 114.72s | firm. But I do still fly in general aviation and


chunk_text:
a talk about yesterday. Anyway, who am I? Well, I'm a really bad pilot. I have had 70.08s - 74.88s | so many bad incidents happen to me. I've landed at the wrong airport by mistake once. That was 74.88s - 79.36s | embarrassing. I had my engine quit on me once. Fortunately, it happened just after I took off, 79.36s - 84.48s | the runway was long, we were fine. I've had my undercarriage hang up twice. That was a bit 84.48s - 88.88s | awkward. And I've very nearly crashed into three other airplanes. So whatever you do, don't fly 88.88s - 93.44s | with me. It's really bad. Navigationally, I also accidentally trolled air traffic control. I was 93.44s - 97.52s | there when I was actually there. That caused a bit of a consternation as well. But hey, 98.64s - 104.48s | fortunately for you, I never made it to commercial. I studied, but I never made it 104.48s - 110.08s | to the airlines, which was a bit of a shame. So instead, back in 2002, I founded a pen testing 110.08s - 114.72s | firm. But I do still fly in general aviation and the sort of fun things I like flying. 115.36s - 120.64s | My favourite airplane is the Piper Cherokee 6. I love it. I also went out to Eastern Europe to 120.64s - 126.16s | learn to fly old Russian airliners, which are great fun. I fly multi-engine airplanes too. 126.16s - 132.08s | But probably the scariest thing I ever did was flew into Courchevel-Alteport, which is in Courchevel 132.08s - 138.08s | in France. It was built for 1992 Olympics. And the runway is at an angle of 20 degrees. 139.12s - 144.40s | If you come in and you get it wrong, basically you crash. You can't put the power on, go around 144.40s - 148.00s | and try again because there's a mountain in the way. And often what happens, and if you go to 148.00s - 153.68s | YouTube, you'll see this, is people land with a bit too much speed and come screeching across the 153.68s - 159.12s | ramp, brakes on fire and go ploughing into the snow bank. There's quite a recent one of a Piper 159.12s - 164.56s | Aztec that went piling in. What they don't show you in the


chunk_text:
the sort of fun things I like flying. 115.36s - 120.64s | My favourite airplane is the Piper Cherokee 6. I love it. I also went out to Eastern Europe to 120.64s - 126.16s | learn to fly old Russian airliners, which are great fun. I fly multi-engine airplanes too. 126.16s - 132.08s | But probably the scariest thing I ever did was flew into Courchevel-Alteport, which is in Courchevel 132.08s - 138.08s | in France. It was built for 1992 Olympics. And the runway is at an angle of 20 degrees. 139.12s - 144.40s | If you come in and you get it wrong, basically you crash. You can't put the power on, go around 144.40s - 148.00s | and try again because there's a mountain in the way. And often what happens, and if you go to 148.00s - 153.68s | YouTube, you'll see this, is people land with a bit too much speed and come screeching across the 153.68s - 159.12s | ramp, brakes on fire and go ploughing into the snow bank. There's quite a recent one of a Piper 159.12s - 164.56s | Aztec that went piling in. What they don't show you in the photograph is there is a bar right on 164.56s - 169.20s | the left there with a viewing gallery and everyone sits there and waits for the airplanes to crash. 170.32s - 175.44s | Amazingly, in the 30-something years it's been open, only two people have been very 175.44s - 179.60s | seriously injured in that time. But they do have lots of crazy things. Anyway, 181.20s - 186.72s | I want to talk about what I'm not. I am not an expert in GPS. It's not my field. I'm not a 186.72s - 192.80s | commercial pilot, fortunately for you. But what I do want to talk about is a series of incidents 192.80s - 199.04s | that I've been told about, that have been published, some haven't, and I'm not going to give answers. 199.92s - 204.88s | What I think I would like to stimulate from this is hopefully your interest in the space too. 205.76s - 209.92s | Go and start asking questions. Go and start learning about GPS and go and learn about some of 209.92s - 213.60s | the interesting issues that we've started seeing over the last couple of years. 214.16s - 220.48s


chunk_text:
photograph is there is a bar right on 164.56s - 169.20s | the left there with a viewing gallery and everyone sits there and waits for the airplanes to crash. 170.32s - 175.44s | Amazingly, in the 30-something years it's been open, only two people have been very 175.44s - 179.60s | seriously injured in that time. But they do have lots of crazy things. Anyway, 181.20s - 186.72s | I want to talk about what I'm not. I am not an expert in GPS. It's not my field. I'm not a 186.72s - 192.80s | commercial pilot, fortunately for you. But what I do want to talk about is a series of incidents 192.80s - 199.04s | that I've been told about, that have been published, some haven't, and I'm not going to give answers. 199.92s - 204.88s | What I think I would like to stimulate from this is hopefully your interest in the space too. 205.76s - 209.92s | Go and start asking questions. Go and start learning about GPS and go and learn about some of 209.92s - 213.60s | the interesting issues that we've started seeing over the last couple of years. 214.16s - 220.48s | So I spend a lot of time working in aviation. I know quite a bit about flying airplanes. I know 220.48s - 224.80s | quite a bit of the navigation systems. I know quite a bit about the cyber security of airplanes 224.80s - 229.84s | too and I know lots of airlines. We're on very good terms with all sorts. I also know about people 229.84s - 237.04s | and how pilots interact, how we manage the cockpit resources and why things go wrong. I have this 237.04s - 244.72s | very weird fascination with reading incident reports about aviation crashes. One thing I love 244.72s - 250.24s | more than anything about the aviation industry, it is safe. And the reason it's safe is we find 250.24s - 256.08s | out what went wrong. Then we write it up without blame and we share it. Imagine if we could do that 256.08s - 263.04s | in the cyber security industry, hey? That is why flying is so safe. Anyway, just before we go there, 263.76s - 269.20s | it's really, really important. If you find vulnerabilities in aviation, you disclose them 269.20s - 274.96s | responsibly and


chunk_text:
| So I spend a lot of time working in aviation. I know quite a bit about flying airplanes. I know 220.48s - 224.80s | quite a bit of the navigation systems. I know quite a bit about the cyber security of airplanes 224.80s - 229.84s | too and I know lots of airlines. We're on very good terms with all sorts. I also know about people 229.84s - 237.04s | and how pilots interact, how we manage the cockpit resources and why things go wrong. I have this 237.04s - 244.72s | very weird fascination with reading incident reports about aviation crashes. One thing I love 244.72s - 250.24s | more than anything about the aviation industry, it is safe. And the reason it's safe is we find 250.24s - 256.08s | out what went wrong. Then we write it up without blame and we share it. Imagine if we could do that 256.08s - 263.04s | in the cyber security industry, hey? That is why flying is so safe. Anyway, just before we go there, 263.76s - 269.20s | it's really, really important. If you find vulnerabilities in aviation, you disclose them 269.20s - 274.96s | responsibly and ethically. It takes a long time to fix things in airplanes. Why? Because we need 274.96s - 280.72s | to be safe. You can't go and drop it like it's hot in aviation. You can't do 90 days Google 280.72s - 287.92s | Project Zero style. Code in aviation has to be certified to make sure it's safe. You can't just 287.92s - 294.08s | push a patch to a plane. It can take a couple of years to fix a vulnerability on an airplane. 294.08s - 299.44s | And for those of you who've seen press reports about planes being hacked from a seat backing 299.44s - 304.64s | coach, no, it doesn't work like that. You can't. The networks are segregated. They don't do that. 304.64s - 308.96s | And there's always someone in control up front. When everything else goes wrong, 308.96s - 313.44s | you've got pilots up there and that's what they're paid to do. They're paid to fly safely. 313.44s - 317.44s | So a little bit of a recap. We need to go back to basics. We're going to go back to what I like to 317.44s - 323.12s | think of as


chunk_text:
ethically. It takes a long time to fix things in airplanes. Why? Because we need 274.96s - 280.72s | to be safe. You can't go and drop it like it's hot in aviation. You can't do 90 days Google 280.72s - 287.92s | Project Zero style. Code in aviation has to be certified to make sure it's safe. You can't just 287.92s - 294.08s | push a patch to a plane. It can take a couple of years to fix a vulnerability on an airplane. 294.08s - 299.44s | And for those of you who've seen press reports about planes being hacked from a seat backing 299.44s - 304.64s | coach, no, it doesn't work like that. You can't. The networks are segregated. They don't do that. 304.64s - 308.96s | And there's always someone in control up front. When everything else goes wrong, 308.96s - 313.44s | you've got pilots up there and that's what they're paid to do. They're paid to fly safely. 313.44s - 317.44s | So a little bit of a recap. We need to go back to basics. We're going to go back to what I like to 317.44s - 323.12s | think of as steam powered instance. One of the very earliest types of navigational aid was 323.12s - 328.56s | a non-directional beacon. It's simply got an indicator in your cockpit that points at the 328.56s - 333.92s | beacon. It's as simple as that. Very straightforward. Has very long range because it follows the 333.92s - 338.88s | curvature of the earth. Unfortunately, there are some weaknesses, one of which being if you're 338.88s - 344.64s | navigating in instrument conditions, so in cloud and there's thunderstorms going on, it'll point at 344.64s - 348.40s | the thunderstorm. So you fly towards the thunderstorm instead of where you were hoping to 348.40s - 355.68s | go. Very cheap to operate. And you often find them in very remote locations. So northern Canada, 355.68s - 360.32s | there are still quite a lot of NDBs around because they've got great range, cheap to operate, and 360.32s - 364.24s | there's not a huge amount of aviation traffic out there at low level. You do still find them. 364.24s - 368.64s | They'll often be the markers or locators on an instrument landing system. So as you fly in, 368.64s - 371.76s | if


chunk_text:
steam powered instance. One of the very earliest types of navigational aid was 323.12s - 328.56s | a non-directional beacon. It's simply got an indicator in your cockpit that points at the 328.56s - 333.92s | beacon. It's as simple as that. Very straightforward. Has very long range because it follows the 333.92s - 338.88s | curvature of the earth. Unfortunately, there are some weaknesses, one of which being if you're 338.88s - 344.64s | navigating in instrument conditions, so in cloud and there's thunderstorms going on, it'll point at 344.64s - 348.40s | the thunderstorm. So you fly towards the thunderstorm instead of where you were hoping to 348.40s - 355.68s | go. Very cheap to operate. And you often find them in very remote locations. So northern Canada, 355.68s - 360.32s | there are still quite a lot of NDBs around because they've got great range, cheap to operate, and 360.32s - 364.24s | there's not a huge amount of aviation traffic out there at low level. You do still find them. 364.24s - 368.64s | They'll often be the markers or locators on an instrument landing system. So as you fly in, 368.64s - 371.76s | if you lift in the cockpit, you hear the outer marker, middle marker, inner marker. 373.89s - 382.13s | Huge advances were made with the VOR. These came to be used in I think 1947 when they first emerged 382.13s - 387.97s | and they were not affected by the same issues with NDBs. They didn't point at thunderstorms and make 387.97s - 392.85s | you fly into lightning, which is great. We like that. They're probably easier to use and follow 393.57s - 398.05s | and they're undoubtedly more accurate, but they are only line of sight. NDB follows the curvature 398.05s - 405.25s | of the earth. VOR, line of sight. And these are typically found at the intersections of airways. 405.25s - 410.61s | When you're flying airway to airway, a turning point will often be accompanied by a VOR on the 410.61s - 414.13s | ground. And if you're ever looking out of the window and you feel the airplane turn, 414.13s - 418.13s | you might want to look down and you might just see this round thing on the ground. That's a VOR. 419.17s - 425.17s | But they are expensive. They're expensive to maintain


chunk_text:
you lift in the cockpit, you hear the outer marker, middle marker, inner marker. 373.89s - 382.13s | Huge advances were made with the VOR. These came to be used in I think 1947 when they first emerged 382.13s - 387.97s | and they were not affected by the same issues with NDBs. They didn't point at thunderstorms and make 387.97s - 392.85s | you fly into lightning, which is great. We like that. They're probably easier to use and follow 393.57s - 398.05s | and they're undoubtedly more accurate, but they are only line of sight. NDB follows the curvature 398.05s - 405.25s | of the earth. VOR, line of sight. And these are typically found at the intersections of airways. 405.25s - 410.61s | When you're flying airway to airway, a turning point will often be accompanied by a VOR on the 410.61s - 414.13s | ground. And if you're ever looking out of the window and you feel the airplane turn, 414.13s - 418.13s | you might want to look down and you might just see this round thing on the ground. That's a VOR. 419.17s - 425.17s | But they are expensive. They're expensive to maintain and they don't give you altitude 425.17s - 434.93s | information. They give you a direction, whereas GPS gives you very precise point in space and time. 436.93s - 441.97s | So because they're quite expensive to maintain, because we've got GPS, which is a lot better, 441.97s - 448.13s | they're starting to be retired. They're starting to disappear. We also use DME, which is 448.13s - 452.21s | essentially a bit like a submarine ping. You send a ping, get a response, time of flight gives you 452.21s - 456.77s | distance. And it's actually very accurate. We use DME typically on an instrument landing system 456.77s - 461.33s | approach. At some point during that approach, we will check DME to make sure that we occur the 461.33s - 468.50s | correct distance from the runway. ILS. You've probably seen these. You see them at the end 468.50s - 475.94s | of the runway. Yeah, that's the localizer. They're amazing bits of equipment, incredibly precise, 475.94s - 482.10s | given it's radio based and allows us to make an approach in what we call Cat 3C. So completely 482.10s - 488.02s | fogged out, the airplane can


chunk_text:
and they don't give you altitude 425.17s - 434.93s | information. They give you a direction, whereas GPS gives you very precise point in space and time. 436.93s - 441.97s | So because they're quite expensive to maintain, because we've got GPS, which is a lot better, 441.97s - 448.13s | they're starting to be retired. They're starting to disappear. We also use DME, which is 448.13s - 452.21s | essentially a bit like a submarine ping. You send a ping, get a response, time of flight gives you 452.21s - 456.77s | distance. And it's actually very accurate. We use DME typically on an instrument landing system 456.77s - 461.33s | approach. At some point during that approach, we will check DME to make sure that we occur the 461.33s - 468.50s | correct distance from the runway. ILS. You've probably seen these. You see them at the end 468.50s - 475.94s | of the runway. Yeah, that's the localizer. They're amazing bits of equipment, incredibly precise, 475.94s - 482.10s | given it's radio based and allows us to make an approach in what we call Cat 3C. So completely 482.10s - 488.02s | fogged out, the airplane can still land safely with a combination of a radio altimeter. The only 488.02s - 495.86s | minor issue with the instrument landing system is it can give false glide slopes. So typically an 495.86s - 503.54s | ILS is aligned at a three degrees angle and you'll also have false signals at six degrees, so multiples 504.34s - 510.74s | nine degrees, 12, etc. So as a result of that, we always used to approach the instrument landing 510.74s - 518.42s | system by flying under it. We'd intersect the glide slope and then we'd get clearance to descend. 518.42s - 522.98s | So we wouldn't typically approach from above because you might end up picking up one of the 522.98s - 529.38s | false GPS approaches. But they're really expensive to maintain. They're incredibly expensive to build 529.94s - 533.86s | and they're incredibly expensive to maintain because you have to calibrate them. And there's 533.86s - 539.38s | this incredible process involving mirrors. So there'll be mirrors set up on the runway and 539.38s - 543.54s | then you'll have a calibration airplane will then fly down, signing lasers off the mirrors, 543.54s - 549.70s | make sure


chunk_text:
still land safely with a combination of a radio altimeter. The only 488.02s - 495.86s | minor issue with the instrument landing system is it can give false glide slopes. So typically an 495.86s - 503.54s | ILS is aligned at a three degrees angle and you'll also have false signals at six degrees, so multiples 504.34s - 510.74s | nine degrees, 12, etc. So as a result of that, we always used to approach the instrument landing 510.74s - 518.42s | system by flying under it. We'd intersect the glide slope and then we'd get clearance to descend. 518.42s - 522.98s | So we wouldn't typically approach from above because you might end up picking up one of the 522.98s - 529.38s | false GPS approaches. But they're really expensive to maintain. They're incredibly expensive to build 529.94s - 533.86s | and they're incredibly expensive to maintain because you have to calibrate them. And there's 533.86s - 539.38s | this incredible process involving mirrors. So there'll be mirrors set up on the runway and 539.38s - 543.54s | then you'll have a calibration airplane will then fly down, signing lasers off the mirrors, 543.54s - 549.70s | make sure it's correctly calibrated. It's expensive. As a result of that, a lot of regional 549.70s - 555.62s | airports are starting to retire their instrument landing systems. Why? Because we've got GPS. GPS 555.62s - 564.26s | is more accurate. Fantastic. And you're starting to see LPV approaches take over where ILS was 564.26s - 571.30s | used before. An example of that, so runway 19 right hand in Las Vegas itself is a GPS approach. 572.34s - 576.26s | The other major runways still have instrument landing systems, but if you're approaching from 576.26s - 584.74s | the north, you'll typically find a GPS based approach. We also use inertial reference. So 584.74s - 591.86s | back in the day, when you were flying something like a 707, you had a navigator on board and that 591.86s - 597.06s | navigator would have had a sextant and there was also a periscope in the roof like there is on the 597.06s - 602.74s | B52 and they would literally do celestial sightings using a sextant and work out where they are. 603.54s - 610.10s | Now we no longer have navigators. We don't really have that option. So inertial


chunk_text:
it's correctly calibrated. It's expensive. As a result of that, a lot of regional 549.70s - 555.62s | airports are starting to retire their instrument landing systems. Why? Because we've got GPS. GPS 555.62s - 564.26s | is more accurate. Fantastic. And you're starting to see LPV approaches take over where ILS was 564.26s - 571.30s | used before. An example of that, so runway 19 right hand in Las Vegas itself is a GPS approach. 572.34s - 576.26s | The other major runways still have instrument landing systems, but if you're approaching from 576.26s - 584.74s | the north, you'll typically find a GPS based approach. We also use inertial reference. So 584.74s - 591.86s | back in the day, when you were flying something like a 707, you had a navigator on board and that 591.86s - 597.06s | navigator would have had a sextant and there was also a periscope in the roof like there is on the 597.06s - 602.74s | B52 and they would literally do celestial sightings using a sextant and work out where they are. 603.54s - 610.10s | Now we no longer have navigators. We don't really have that option. So inertial reference was used, 610.10s - 613.86s | particularly where we're not flying over land, where we don't have ground based beacons. 613.86s - 619.14s | And it means that simply relying on a very, very accurate accelerometer, the one on the right is 619.30s - 626.10s | the inertial reference system from Concorde, gyro based, and the one on the left is the much 626.10s - 632.18s | more recent version, which is laser based gyros. They are so accurate that on a 3000 nautical mile 632.18s - 637.94s | flight from say London to New York, you could be as little as one nautical mile off position, 637.94s - 643.22s | which is phenomenal advances, but actually not great if you then want to approach and land. 644.18s - 648.34s | You need to be a bit better than one nautical mile away from the runway. That'd be a bad day. 649.62s - 655.94s | So as we're starting to see conventional nav aids start to be retired because they're expensive and 655.94s - 661.94s | not as accurate, we're starting to see them being removed. And particularly the VORs that are off 661.94s - 668.66s | airway routes,


chunk_text:
reference was used, 610.10s - 613.86s | particularly where we're not flying over land, where we don't have ground based beacons. 613.86s - 619.14s | And it means that simply relying on a very, very accurate accelerometer, the one on the right is 619.30s - 626.10s | the inertial reference system from Concorde, gyro based, and the one on the left is the much 626.10s - 632.18s | more recent version, which is laser based gyros. They are so accurate that on a 3000 nautical mile 632.18s - 637.94s | flight from say London to New York, you could be as little as one nautical mile off position, 637.94s - 643.22s | which is phenomenal advances, but actually not great if you then want to approach and land. 644.18s - 648.34s | You need to be a bit better than one nautical mile away from the runway. That'd be a bad day. 649.62s - 655.94s | So as we're starting to see conventional nav aids start to be retired because they're expensive and 655.94s - 661.94s | not as accurate, we're starting to see them being removed. And particularly the VORs that are off 661.94s - 668.66s | airway routes, they're being retired. There's also a lot of VORs are still part of the approach. So 668.66s - 673.30s | for example, a standard approach route or a standard instrument departure will often involve 673.38s - 679.78s | a VOR. One of my favourite, why do I have a favourite VOR? I don't know. There's a proposal 679.78s - 684.98s | to recover Delta Tango, sorry, retired Delta Tango Yankee, which is a critical part or was 684.98s - 691.95s | a critical part of a number of the standard approaches into London's Heathrow. 10 years ago, 691.95s - 699.63s | we had 44 VORs in the UK, we're now down to below 19. So we're starting to rely increasingly 700.27s - 706.83s | on GPS. Now let's look at some of the incidents that we've stumbled onto. I would strongly 706.83s - 710.11s | recommend if you want to learn more about this, go and follow the Ops Group. Really 710.11s - 715.23s | interesting grouping, gathering data, have real time GPS spoofing and jamming reports. 716.43s - 722.35s | As I'm sure you've started to see, we're starting to see position errors, particularly around areas 722.35s - 728.03s


chunk_text:
they're being retired. There's also a lot of VORs are still part of the approach. So 668.66s - 673.30s | for example, a standard approach route or a standard instrument departure will often involve 673.38s - 679.78s | a VOR. One of my favourite, why do I have a favourite VOR? I don't know. There's a proposal 679.78s - 684.98s | to recover Delta Tango, sorry, retired Delta Tango Yankee, which is a critical part or was 684.98s - 691.95s | a critical part of a number of the standard approaches into London's Heathrow. 10 years ago, 691.95s - 699.63s | we had 44 VORs in the UK, we're now down to below 19. So we're starting to rely increasingly 700.27s - 706.83s | on GPS. Now let's look at some of the incidents that we've stumbled onto. I would strongly 706.83s - 710.11s | recommend if you want to learn more about this, go and follow the Ops Group. Really 710.11s - 715.23s | interesting grouping, gathering data, have real time GPS spoofing and jamming reports. 716.43s - 722.35s | As I'm sure you've started to see, we're starting to see position errors, particularly around areas 722.35s - 728.03s | of conflict. There's a lot going on in Eastern Europe and Ukraine, obviously. And part of that, 728.03s - 732.67s | we believe, is there to mitigate drone-based attacks. A lot of consumer drones rather than 732.67s - 737.39s | military drones are being used. They rely on GPS in some cases. So to mitigate an attack, 737.95s - 744.19s | you would jam or spoof GPS. We saw a lot of jamming and spoofing going on in the Black Sea, 744.19s - 748.27s | but that was typically for shipping. So around military installations in the Black Sea, 748.27s - 755.17s | you'd often get a 20 nautical mile position error when you were at sea. It's increased massively 755.17s - 760.53s | though. The last report I read had a 400% increase, which is huge. We're seeing moves 760.53s - 767.41s | away from jamming towards position errors. Position can be incredibly interesting. Now, 768.05s - 773.09s | for safety reasons, when we're approaching to land, we will have the ground proximity 773.09s - 778.61s | warning system. So if we descend too low or we start flying towards hills, which would be really 778.61s - 785.97s


chunk_text:
| of conflict. There's a lot going on in Eastern Europe and Ukraine, obviously. And part of that, 728.03s - 732.67s | we believe, is there to mitigate drone-based attacks. A lot of consumer drones rather than 732.67s - 737.39s | military drones are being used. They rely on GPS in some cases. So to mitigate an attack, 737.95s - 744.19s | you would jam or spoof GPS. We saw a lot of jamming and spoofing going on in the Black Sea, 744.19s - 748.27s | but that was typically for shipping. So around military installations in the Black Sea, 748.27s - 755.17s | you'd often get a 20 nautical mile position error when you were at sea. It's increased massively 755.17s - 760.53s | though. The last report I read had a 400% increase, which is huge. We're seeing moves 760.53s - 767.41s | away from jamming towards position errors. Position can be incredibly interesting. Now, 768.05s - 773.09s | for safety reasons, when we're approaching to land, we will have the ground proximity 773.09s - 778.61s | warning system. So if we descend too low or we start flying towards hills, which would be really 778.61s - 785.97s | bad, the GPWS will give us an alert and say, too low, pull up. But if you've got a position error, 785.97s - 791.09s | you're flying down your ILS, the GPWS thinks you're somewhere else because it's being spoofed 791.65s - 798.21s | and triggers. First thing you have to do is go around. So we're seeing numerous flights have to 798.21s - 802.45s | go around and try again because they're getting position errors that are triggering the ground 802.45s - 810.05s | proximity. We're also seeing some interesting issues around poisoning. Now, inertial reference, 810.05s - 814.21s | I mentioned there, it's not as accurate, right? It's great, but it's not as accurate as GPS. 814.85s - 819.97s | So therefore we would deprecate to GPS as the most accurate source of position and time on 819.97s - 827.57s | the airplane. So the IRS will be updated by the GPS pretty frequently. So when we start to see 827.57s - 832.69s | position errors, what we're then starting to see is inertial reference then becomes poisoned 832.69s - 838.45s | by GPS. And when the instructions to pilots is if you are experiencing spoofing or


chunk_text:
| bad, the GPWS will give us an alert and say, too low, pull up. But if you've got a position error, 785.97s - 791.09s | you're flying down your ILS, the GPWS thinks you're somewhere else because it's being spoofed 791.65s - 798.21s | and triggers. First thing you have to do is go around. So we're seeing numerous flights have to 798.21s - 802.45s | go around and try again because they're getting position errors that are triggering the ground 802.45s - 810.05s | proximity. We're also seeing some interesting issues around poisoning. Now, inertial reference, 810.05s - 814.21s | I mentioned there, it's not as accurate, right? It's great, but it's not as accurate as GPS. 814.85s - 819.97s | So therefore we would deprecate to GPS as the most accurate source of position and time on 819.97s - 827.57s | the airplane. So the IRS will be updated by the GPS pretty frequently. So when we start to see 827.57s - 832.69s | position errors, what we're then starting to see is inertial reference then becomes poisoned 832.69s - 838.45s | by GPS. And when the instructions to pilots is if you are experiencing spoofing or likely to 838.45s - 843.89s | experience spoofing, you would then switch from GPS to inertial reference so you don't see poisoning 843.89s - 854.08s | going on. We've seen anecdotal reports pop up around airplanes not able to reacquire. You go 854.08s - 861.12s | into an area of spoofing, you lose GPS, you then leave the area of spoofing and jamming 862.48s - 868.16s | some distance later. Now, in order to see the satellites in the skies, you need to know where 868.16s - 872.48s | they are. And that's your satellite almanac, which is part of a GPS system. The multimode receivers, 872.48s - 879.60s | which will gather that data, we've seen reports where you get beyond the jamming area and the MMR 879.60s - 883.28s | can't now reacquire the signal because the satellites aren't where it thinks they are. 884.80s - 889.68s | There have been all sorts of reports of course position jamming causing problems around areas 889.68s - 894.64s | of perhaps what we might call hostile airspace, places we wouldn't really want to fly into where 894.64s - 899.68s | maybe it's a war zone or an unfriendly hostile nation.


chunk_text:
likely to 838.45s - 843.89s | experience spoofing, you would then switch from GPS to inertial reference so you don't see poisoning 843.89s - 854.08s | going on. We've seen anecdotal reports pop up around airplanes not able to reacquire. You go 854.08s - 861.12s | into an area of spoofing, you lose GPS, you then leave the area of spoofing and jamming 862.48s - 868.16s | some distance later. Now, in order to see the satellites in the skies, you need to know where 868.16s - 872.48s | they are. And that's your satellite almanac, which is part of a GPS system. The multimode receivers, 872.48s - 879.60s | which will gather that data, we've seen reports where you get beyond the jamming area and the MMR 879.60s - 883.28s | can't now reacquire the signal because the satellites aren't where it thinks they are. 884.80s - 889.68s | There have been all sorts of reports of course position jamming causing problems around areas 889.68s - 894.64s | of perhaps what we might call hostile airspace, places we wouldn't really want to fly into where 894.64s - 899.68s | maybe it's a war zone or an unfriendly hostile nation. You do not want to be accidentally flying 899.68s - 905.84s | into their airspace. That reset process, if they're no longer working, needs to be done on 905.84s - 911.52s | the ground so the planes are no longer moving, it can reacquire correctly. Interestingly, 911.52s - 915.28s | more modern multimode receivers don't seem to be as vulnerable. They seem to be better at 915.28s - 918.72s | reacquiring afterwards compared to some of the older multimode receivers that are in 918.72s - 922.08s | slightly older airplanes. Really interesting. I haven't got to the bottom of that. 923.36s - 930.64s | Now, when we do see GPS jamming and spoofing going on, there'll often be a notice to airmen, 930.64s - 935.68s | a NOTAM, and that tells the pilots, look, you're really likely to receive some jamming or spoofing 936.32s - 945.20s | there. So before you go there, switch. But remember, we're retiring older base nav-aids. 945.20s - 949.76s | We're starting to retire our instrument landing systems in favour of GPS. But now we've got 949.76s - 956.40s | position problems. There was a really interesting incident at Tartu airport in Estonia. So Finnair


chunk_text:
You do not want to be accidentally flying 899.68s - 905.84s | into their airspace. That reset process, if they're no longer working, needs to be done on 905.84s - 911.52s | the ground so the planes are no longer moving, it can reacquire correctly. Interestingly, 911.52s - 915.28s | more modern multimode receivers don't seem to be as vulnerable. They seem to be better at 915.28s - 918.72s | reacquiring afterwards compared to some of the older multimode receivers that are in 918.72s - 922.08s | slightly older airplanes. Really interesting. I haven't got to the bottom of that. 923.36s - 930.64s | Now, when we do see GPS jamming and spoofing going on, there'll often be a notice to airmen, 930.64s - 935.68s | a NOTAM, and that tells the pilots, look, you're really likely to receive some jamming or spoofing 936.32s - 945.20s | there. So before you go there, switch. But remember, we're retiring older base nav-aids. 945.20s - 949.76s | We're starting to retire our instrument landing systems in favour of GPS. But now we've got 949.76s - 956.40s | position problems. There was a really interesting incident at Tartu airport in Estonia. So Finnair 956.40s - 961.68s | suspended their flights, they were flying ATR-72s in there I believe, and they started to experience 962.24s - 967.60s | GPS spoofing and jamming and couldn't safely approach the airport. So they suspended flights 967.60s - 972.16s | for a couple of months while they looked for other sources of data and they ended up settling 972.16s - 976.96s | back on distance measuring equipment to ensure that if they were spoofed, they could correctly 976.96s - 980.96s | approach the airport. But we started to see these issues affecting real flights. 982.72s - 986.64s | But where I really want to move on to is the concept of time. We think too much, to my mind, 986.64s - 993.76s | about GPS being a source of position, but it's actually a source of time. We're starting to see 993.84s - 1000.24s | reports of the clocks on board airplanes during spoofing events start to do weird things. 1001.36s - 1005.44s | Initially, we were starting to see very minor errors, so maybe it would jump forward a minute 1005.44s - 1010.88s | or so, maybe even go back. And in that situation, pilots were advised,


chunk_text:
956.40s - 961.68s | suspended their flights, they were flying ATR-72s in there I believe, and they started to experience 962.24s - 967.60s | GPS spoofing and jamming and couldn't safely approach the airport. So they suspended flights 967.60s - 972.16s | for a couple of months while they looked for other sources of data and they ended up settling 972.16s - 976.96s | back on distance measuring equipment to ensure that if they were spoofed, they could correctly 976.96s - 980.96s | approach the airport. But we started to see these issues affecting real flights. 982.72s - 986.64s | But where I really want to move on to is the concept of time. We think too much, to my mind, 986.64s - 993.76s | about GPS being a source of position, but it's actually a source of time. We're starting to see 993.84s - 1000.24s | reports of the clocks on board airplanes during spoofing events start to do weird things. 1001.36s - 1005.44s | Initially, we were starting to see very minor errors, so maybe it would jump forward a minute 1005.44s - 1010.88s | or so, maybe even go back. And in that situation, pilots were advised, it's part of their quick 1010.88s - 1015.60s | reference handbook, to switch back to the local clock on the airplane rather than rely on the 1015.60s - 1024.56s | GPS one that was doing weird things. This is an incident I was party to. The GPS time did 1024.56s - 1030.32s | something really weird. It rolled forward a very large amount, not something that's been widely 1030.32s - 1034.96s | seen. Because it happened quickly, the pilots weren't able to switch the local time and it 1034.96s - 1039.12s | caused a series of follow-up incidents. And you start to realise how important time is to an 1039.12s - 1047.12s | airplane. It started to cause the digital certificates used for electronic communication 1047.12s - 1051.92s | to become invalid. They weren't expired like we'd expect a certificate, they just weren't valid 1051.92s - 1055.68s | because the time was too far in the future. One of the first effects, and you'll probably see this 1055.68s - 1059.60s | as a passenger Wi-Fi might fail. Why? Because its digital certificates aren't valid anymore. 1060.24s - 1065.92s | You then start to see issues around the controller to pilot


chunk_text:
it's part of their quick 1010.88s - 1015.60s | reference handbook, to switch back to the local clock on the airplane rather than rely on the 1015.60s - 1024.56s | GPS one that was doing weird things. This is an incident I was party to. The GPS time did 1024.56s - 1030.32s | something really weird. It rolled forward a very large amount, not something that's been widely 1030.32s - 1034.96s | seen. Because it happened quickly, the pilots weren't able to switch the local time and it 1034.96s - 1039.12s | caused a series of follow-up incidents. And you start to realise how important time is to an 1039.12s - 1047.12s | airplane. It started to cause the digital certificates used for electronic communication 1047.12s - 1051.92s | to become invalid. They weren't expired like we'd expect a certificate, they just weren't valid 1051.92s - 1055.68s | because the time was too far in the future. One of the first effects, and you'll probably see this 1055.68s - 1059.60s | as a passenger Wi-Fi might fail. Why? Because its digital certificates aren't valid anymore. 1060.24s - 1065.92s | You then start to see issues around the controller to pilot data link communication, 1065.92s - 1072.56s | which requires an accurate source of time. That's now not working, so you're now back to VHF. 1073.60s - 1078.08s | Now in this particular incident, the flight landed safely. Pilots asked for radar vectors 1078.88s - 1083.36s | and they landed fine. We expected them to land fine, that was not an issue. 1084.40s - 1088.96s | But you see time being a really important component of other parts of the airplane 1088.96s - 1093.60s | communications too. So TCAS, the Collision Avoidance Service, that's what stops airplanes 1093.60s - 1100.48s | flying into each other. Great, we like that. The latest versions of TCAS allow for even 1102.32s - 1106.72s | less spacing, so we can use airspace more efficiently, but it's still super safe 1106.72s - 1112.08s | because we have GPS as precise sources of time. So we're starting to see TCAS causing issues. 1112.08s - 1117.84s | Even something as simple as logging of incidents on an airplane. What do we need when we're creating 1117.84s - 1123.52s | logs? An accurate source of time. So what is the authoritative source of time on board? 1123.52s - 1130.30s


chunk_text:
data link communication, 1065.92s - 1072.56s | which requires an accurate source of time. That's now not working, so you're now back to VHF. 1073.60s - 1078.08s | Now in this particular incident, the flight landed safely. Pilots asked for radar vectors 1078.88s - 1083.36s | and they landed fine. We expected them to land fine, that was not an issue. 1084.40s - 1088.96s | But you see time being a really important component of other parts of the airplane 1088.96s - 1093.60s | communications too. So TCAS, the Collision Avoidance Service, that's what stops airplanes 1093.60s - 1100.48s | flying into each other. Great, we like that. The latest versions of TCAS allow for even 1102.32s - 1106.72s | less spacing, so we can use airspace more efficiently, but it's still super safe 1106.72s - 1112.08s | because we have GPS as precise sources of time. So we're starting to see TCAS causing issues. 1112.08s - 1117.84s | Even something as simple as logging of incidents on an airplane. What do we need when we're creating 1117.84s - 1123.52s | logs? An accurate source of time. So what is the authoritative source of time on board? 1123.52s - 1130.30s | Well what's the most accurate source of time? GPS. What was really interesting about this incident 1130.30s - 1136.94s | was that the time can actually be quite hard to re-establish. Now I've seen varying reports, 1136.94s - 1142.14s | I've seen time go forward, I've heard about time going back as well. But in this particular 1142.14s - 1148.30s | incident, there are protections in place to stop the time being rolled back. Why would time go back? 1148.46s - 1154.22s | We wouldn't do that, would we? But actually we're not quite sure whether this is just this airplane, 1155.34s - 1159.26s | the type of airplane, or even the manufacturer. We're not sure. There needs to be a lot more 1159.26s - 1166.94s | work done here. But they couldn't roll the time back. There were protections in place to stop 1166.94s - 1172.70s | the time that they'd go forward, but not back. And as a result, the airplane, most of the components 1172.70s - 1177.50s | on it, had to be reflashed, which was a hugely expensive and time-consuming maintenance problem 1177.58s - 1184.70s | issue. Cost directly, but most importantly, downtime on the


chunk_text:
| Well what's the most accurate source of time? GPS. What was really interesting about this incident 1130.30s - 1136.94s | was that the time can actually be quite hard to re-establish. Now I've seen varying reports, 1136.94s - 1142.14s | I've seen time go forward, I've heard about time going back as well. But in this particular 1142.14s - 1148.30s | incident, there are protections in place to stop the time being rolled back. Why would time go back? 1148.46s - 1154.22s | We wouldn't do that, would we? But actually we're not quite sure whether this is just this airplane, 1155.34s - 1159.26s | the type of airplane, or even the manufacturer. We're not sure. There needs to be a lot more 1159.26s - 1166.94s | work done here. But they couldn't roll the time back. There were protections in place to stop 1166.94s - 1172.70s | the time that they'd go forward, but not back. And as a result, the airplane, most of the components 1172.70s - 1177.50s | on it, had to be reflashed, which was a hugely expensive and time-consuming maintenance problem 1177.58s - 1184.70s | issue. Cost directly, but most importantly, downtime on the airplane. It was down for a 1184.70s - 1189.02s | significant period of time whilst everything was reflashed and time was brought back to normal. 1190.14s - 1196.14s | Planes are very connected. Planes do lots of connectivity. Even something as simple as a data 1196.14s - 1203.82s | loader requires a source of time. The SATCOMs require a source of time. Connectivity and safety 1203.82s - 1208.94s | aboard airplanes needs the time to be right. So what do I take from this? Well, 1209.74s - 1215.90s | it's pretty straightforward to spoof GPS. It's not that complicated. It doesn't require much 1215.90s - 1222.62s | power. GPS is a very weak signal. A few watts will do it. It seems to be specific to some planes, 1223.58s - 1228.46s | but I think more research is needed. And also I think as engineers become more familiar with the 1228.46s - 1234.54s | process, I think we'll see maintenance, for instance like this, become much less disruptive, 1234.54s - 1242.62s | which I think is great. What is the future? Well, hybrid. Using GPS, but correlating it with 1242.62s - 1247.98s | systems on the ground that we know


chunk_text:
airplane. It was down for a 1184.70s - 1189.02s | significant period of time whilst everything was reflashed and time was brought back to normal. 1190.14s - 1196.14s | Planes are very connected. Planes do lots of connectivity. Even something as simple as a data 1196.14s - 1203.82s | loader requires a source of time. The SATCOMs require a source of time. Connectivity and safety 1203.82s - 1208.94s | aboard airplanes needs the time to be right. So what do I take from this? Well, 1209.74s - 1215.90s | it's pretty straightforward to spoof GPS. It's not that complicated. It doesn't require much 1215.90s - 1222.62s | power. GPS is a very weak signal. A few watts will do it. It seems to be specific to some planes, 1223.58s - 1228.46s | but I think more research is needed. And also I think as engineers become more familiar with the 1228.46s - 1234.54s | process, I think we'll see maintenance, for instance like this, become much less disruptive, 1234.54s - 1242.62s | which I think is great. What is the future? Well, hybrid. Using GPS, but correlating it with 1242.62s - 1247.98s | systems on the ground that we know about. There are already sources of information on the ground. 1247.98s - 1253.50s | We've got existing nav aids on the ground that we can cross-check with to make sure that the 1253.50s - 1259.42s | GPS position we're receiving, the GPS time we're receiving is correct. But we need to think 1259.42s - 1265.98s | carefully about retiring all those existing steam-powered navigation aids that are on the 1265.98s - 1270.94s | ground. Because if we get too excited about it, we're not going to have anything to be hybrid against. 1272.62s - 1279.10s | Scary. Let's just put aviation aside for a moment. It's not just aviation that uses GPS. 1279.58s - 1283.50s | Financial services need a really accurate source of time for high-frequency trading. 1283.50s - 1288.14s | A lot of industrial control systems use GPS. There are lots of other areas where GPS is used as a 1288.14s - 1293.02s | trusted source of time. And spoofing in financial services, I'm not quite sure how that would work, 1293.82s - 1297.26s | because you've got a stationary target rather than something up there. But it does get you 1297.26s - 1301.82s | thinking, doesn't it?


chunk_text:
about. There are already sources of information on the ground. 1247.98s - 1253.50s | We've got existing nav aids on the ground that we can cross-check with to make sure that the 1253.50s - 1259.42s | GPS position we're receiving, the GPS time we're receiving is correct. But we need to think 1259.42s - 1265.98s | carefully about retiring all those existing steam-powered navigation aids that are on the 1265.98s - 1270.94s | ground. Because if we get too excited about it, we're not going to have anything to be hybrid against. 1272.62s - 1279.10s | Scary. Let's just put aviation aside for a moment. It's not just aviation that uses GPS. 1279.58s - 1283.50s | Financial services need a really accurate source of time for high-frequency trading. 1283.50s - 1288.14s | A lot of industrial control systems use GPS. There are lots of other areas where GPS is used as a 1288.14s - 1293.02s | trusted source of time. And spoofing in financial services, I'm not quite sure how that would work, 1293.82s - 1297.26s | because you've got a stationary target rather than something up there. But it does get you 1297.26s - 1301.82s | thinking, doesn't it? It does let you realise how important time is. Now, there's some further 1301.82s - 1307.66s | watching. I really want you to watch one of my colleagues in the aerospace village give a talk 1307.66s - 1312.22s | a bit later on. He's talking about the world of PKI in airplanes. Really, really interesting and 1312.22s - 1315.34s | very relevant to what we've been talking about today. It's going to be in Crater Stage 2 at 1315.34s - 1319.10s | half past five down the way there. But that's me. I hope you found it interesting. I'd be 1319.10s - 1322.06s | glad to take some questions if you want to come to the front. Thank you.


chunk_text:
It does let you realise how important time is. Now, there's some further 1301.82s - 1307.66s | watching. I really want you to watch one of my colleagues in the aerospace village give a talk 1307.66s - 1312.22s | a bit later on. He's talking about the world of PKI in airplanes. Really, really interesting and 1312.22s - 1315.34s | very relevant to what we've been talking about today. It's going to be in Crater Stage 2 at 1315.34s - 1319.10s | half past five down the way there. But that's me. I hope you found it interesting. I'd be 1319.10s - 1322.06s | glad to take some questions if you want to come to the front. Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=uCcyd3lTPXk", "title": "DEF CON 32 - MFT Malicious Fungible Tokens - Mauro Eldritch, Cybelle Oliveira", "description": "In this technical talk, we will uncover a new aspect of NFTs: using them as attack vectors to relay C2 commands. Fingerprinting a system? Exfiltrating information? Encrypting and wiping data? Executing arbitrary commands? Of course! But with a dark twist: deployed NFTs are blockchain-backed assets immune to takedowns. Imagine having your own \u201cimmortal\u201d C2 Server for less than $10 dollars in $ETH.\n\nFor this, we will introduce \u201cmFT\u201d an open-source tool that automates the creation of malicious payloads and provide sample harmless NFTs, allowing attendees to explore this novel attack vector on their own machines safely. This talk is the spiritual successor of \"Everything is a C2 if you're brave enough\".", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1300, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.76s | This text was transcribed using whisper model: large-v2 Welcome, everybody, to our talk, Malicious Fungible Tokens. 3.50s - 7.22s | My name is Mauro and my partner today is Ivel, and we welcome you. 7.22s - 8.34s | Thank you for choosing our talk. 10.02s - 11.84s | Hey, everyone, good evening. 11.84s - 13.22s | Hi, how are you doing? 13.22s - 15.68s | Thanks for being here to our talk. 15.68s - 18.44s | First, of course, English is not our first language. 18.44s - 19.90s | We have a little bit accent. 19.90s - 24.36s | So if you don't understand any word, please raise your hands or say 24.36s - 26.82s | you are saying so much bullshit in English. 26.98s - 31.32s | That's OK, because we can speak, improve our English. 31.32s - 33.40s | OK, thank you. 33.40s - 34.44s | So let's start. 35.56s - 37.24s | As I said, my name is Ivel. 37.24s - 39.16s | I'm from Brazil, Sao Paulo, Brazil. 39.16s - 41.12s | I work at Cyber Threat Intelligence. 41.12s - 44.08s | And well, I like malware. 44.08s - 48.20s | I like to research about malware, hands-on wares and things like this. 48.46s - 51.62s | It's pretty cool. You know, I know how it works. 53.54s - 54.68s | Well, my name is Mauro. 54.68s - 56.64s | I'm a Uruguayan-Argentinian hacker. 56.66s - 58.50s | I'm here today to show this talk. 58.50s - 60.80s | And I spoke at


chunk_text:
how are you doing? 13.22s - 15.68s | Thanks for being here to our talk. 15.68s - 18.44s | First, of course, English is not our first language. 18.44s - 19.90s | We have a little bit accent. 19.90s - 24.36s | So if you don't understand any word, please raise your hands or say 24.36s - 26.82s | you are saying so much bullshit in English. 26.98s - 31.32s | That's OK, because we can speak, improve our English. 31.32s - 33.40s | OK, thank you. 33.40s - 34.44s | So let's start. 35.56s - 37.24s | As I said, my name is Ivel. 37.24s - 39.16s | I'm from Brazil, Sao Paulo, Brazil. 39.16s - 41.12s | I work at Cyber Threat Intelligence. 41.12s - 44.08s | And well, I like malware. 44.08s - 48.20s | I like to research about malware, hands-on wares and things like this. 48.46s - 51.62s | It's pretty cool. You know, I know how it works. 53.54s - 54.68s | Well, my name is Mauro. 54.68s - 56.64s | I'm a Uruguayan-Argentinian hacker. 56.66s - 58.50s | I'm here today to show this talk. 58.50s - 60.80s | And I spoke at different events around the world. 60.80s - 63.58s | And I'm the leader of the BITSOC Quetzal team, which is the first 63.58s - 67.04s | Latin American Web3 Threats Research Team. 69.94s - 75.38s | This talk, we are going to use NFTs as immortal command and control servers. 75.62s - 77.46s | We are not going to sell you any NFT. 77.46s - 80.08s | We are not going to try to put you into crypto. 80.08s - 82.46s | So we are not going to make you invest into anything. 82.46s - 85.54s | This talk is the continuation or the spiritual successor of 85.56s - 87.76s | Everything is a C2, if you're brave enough, 87.76s - 91.50s | which was a talk at the previous Adversary Village, where we used the Spotify, 91.72s - 96.30s | World of Warcraft, Wikipedia and whatever you can name as a C2 server in the past. 97.94s - 103.52s | So this talk is 30 minutes only, but it's divided in two parts, OK? 103.70s - 107.62s | First, I will give ingredients and then, Mauro, you cook this. 107.66s - 110.16s | OK, first, let me introduce you.


chunk_text:
different events around the world. 60.80s - 63.58s | And I'm the leader of the BITSOC Quetzal team, which is the first 63.58s - 67.04s | Latin American Web3 Threats Research Team. 69.94s - 75.38s | This talk, we are going to use NFTs as immortal command and control servers. 75.62s - 77.46s | We are not going to sell you any NFT. 77.46s - 80.08s | We are not going to try to put you into crypto. 80.08s - 82.46s | So we are not going to make you invest into anything. 82.46s - 85.54s | This talk is the continuation or the spiritual successor of 85.56s - 87.76s | Everything is a C2, if you're brave enough, 87.76s - 91.50s | which was a talk at the previous Adversary Village, where we used the Spotify, 91.72s - 96.30s | World of Warcraft, Wikipedia and whatever you can name as a C2 server in the past. 97.94s - 103.52s | So this talk is 30 minutes only, but it's divided in two parts, OK? 103.70s - 107.62s | First, I will give ingredients and then, Mauro, you cook this. 107.66s - 110.16s | OK, first, let me introduce you. 110.16s - 114.74s | Podo, or Leopoldo, is his dog, Amazing Dog, a golden retriever. 115.12s - 118.90s | OK, so let's talk. 118.94s - 126.62s | Let's clarify what NFTs, C2 servers and lovely golden retriever, the lovely dog. 127.00s - 132.34s | So NFTs, basically they are all information when you 133.96s - 137.50s | upload, you know, an NFT in a blockchain. 137.72s - 139.68s | This is all information storage. 139.68s - 142.14s | And well, everything is there. 142.50s - 145.38s | Data, metadata and things like that. 145.76s - 148.64s | But you can store this image as well. 148.64s - 154.84s | And off-chain, I mean, in a decentralized platform for this. 155.10s - 158.48s | And it's immortal as well. 158.48s - 162.22s | You know, you can change like in blockchain. 162.44s - 164.28s | This is very important. 164.28s - 165.48s | So we have two types. 165.48s - 170.58s | You know how we can store our image on-chain and off-chain. 171.42s - 173.48s | On blockchain and not in the blockchain. 174.26s - 176.06s | Oops, sorry. 176.32s - 177.90s | OK, sorry. 178.10s - 180.90s | So


chunk_text:
110.16s - 114.74s | Podo, or Leopoldo, is his dog, Amazing Dog, a golden retriever. 115.12s - 118.90s | OK, so let's talk. 118.94s - 126.62s | Let's clarify what NFTs, C2 servers and lovely golden retriever, the lovely dog. 127.00s - 132.34s | So NFTs, basically they are all information when you 133.96s - 137.50s | upload, you know, an NFT in a blockchain. 137.72s - 139.68s | This is all information storage. 139.68s - 142.14s | And well, everything is there. 142.50s - 145.38s | Data, metadata and things like that. 145.76s - 148.64s | But you can store this image as well. 148.64s - 154.84s | And off-chain, I mean, in a decentralized platform for this. 155.10s - 158.48s | And it's immortal as well. 158.48s - 162.22s | You know, you can change like in blockchain. 162.44s - 164.28s | This is very important. 164.28s - 165.48s | So we have two types. 165.48s - 170.58s | You know how we can store our image on-chain and off-chain. 171.42s - 173.48s | On blockchain and not in the blockchain. 174.26s - 176.06s | Oops, sorry. 176.32s - 177.90s | OK, sorry. 178.10s - 180.90s | So what is a C2 command and control servers? 181.12s - 185.98s | It's a server that we can send and receive information of malware. 185.98s - 189.66s | So we can use this in anywhere, right? 189.66s - 191.16s | But not in this case. 191.42s - 198.34s | But the problem is if I try to do something in NFT, if I use a regular server, 198.38s - 200.68s | you know, for C2, what can happen? 201.14s - 207.56s | This can be banned or blacklisted, you know, and the list that 207.98s - 213.32s | denies a list or everything can be messy and can be taken down, 213.32s - 215.78s | even if it's in Tor browser. 215.98s - 220.58s | So, yeah, it works, of course, but not in this case. 220.58s - 224.82s | This particular case, we need something more resilient, right? 224.82s - 235.36s | OK, so, as I said, blockchain, I don't know if everybody's familiar with blockchain, 235.36s - 236.40s | I guess, right? 236.58s - 241.08s | So everything is there, back that sits there is permanent. 241.08s - 243.78s | You can change, it's there and that's it.


chunk_text:
what is a C2 command and control servers? 181.12s - 185.98s | It's a server that we can send and receive information of malware. 185.98s - 189.66s | So we can use this in anywhere, right? 189.66s - 191.16s | But not in this case. 191.42s - 198.34s | But the problem is if I try to do something in NFT, if I use a regular server, 198.38s - 200.68s | you know, for C2, what can happen? 201.14s - 207.56s | This can be banned or blacklisted, you know, and the list that 207.98s - 213.32s | denies a list or everything can be messy and can be taken down, 213.32s - 215.78s | even if it's in Tor browser. 215.98s - 220.58s | So, yeah, it works, of course, but not in this case. 220.58s - 224.82s | This particular case, we need something more resilient, right? 224.82s - 235.36s | OK, so, as I said, blockchain, I don't know if everybody's familiar with blockchain, 235.36s - 236.40s | I guess, right? 236.58s - 241.08s | So everything is there, back that sits there is permanent. 241.08s - 243.78s | You can change, it's there and that's it. 244.00s - 246.08s | You just upload there and you keep there. 246.24s - 249.62s | Can ban it, can flag anything. 249.92s - 258.18s | But usually NFTs can be stored there or no, can be NFT is an image. 259.18s - 266.98s | In NFT image, you can put like name, description, trade and everything, including metadata is there, right? 268.44s - 277.38s | So instead we do this with that ugly monkeys, we everybody saw that ugly monkeys aware or weird image 277.42s - 283.88s | because we see weird image from artists that say, oh, this is a brand new thing, but it's not my thing. 283.88s - 287.26s | Sorry. What about Golden Retriever? 287.34s - 289.06s | They are really, really cool. 289.06s - 291.02s | And as a dog, too bad it's not a cat. 291.02s - 292.52s | But let's start with a dog. 292.52s - 293.86s | Maybe the next time, right? 294.40s - 297.98s | Maybe. Now let's explain what is this. 298.90s - 301.94s | Mostly NFTs, there's a platform. 301.94s - 306.28s | The most known one is OpenSea, that one with the ugly monkey. 307.26s - 311.14s


chunk_text:
244.00s - 246.08s | You just upload there and you keep there. 246.24s - 249.62s | Can ban it, can flag anything. 249.92s - 258.18s | But usually NFTs can be stored there or no, can be NFT is an image. 259.18s - 266.98s | In NFT image, you can put like name, description, trade and everything, including metadata is there, right? 268.44s - 277.38s | So instead we do this with that ugly monkeys, we everybody saw that ugly monkeys aware or weird image 277.42s - 283.88s | because we see weird image from artists that say, oh, this is a brand new thing, but it's not my thing. 283.88s - 287.26s | Sorry. What about Golden Retriever? 287.34s - 289.06s | They are really, really cool. 289.06s - 291.02s | And as a dog, too bad it's not a cat. 291.02s - 292.52s | But let's start with a dog. 292.52s - 293.86s | Maybe the next time, right? 294.40s - 297.98s | Maybe. Now let's explain what is this. 298.90s - 301.94s | Mostly NFTs, there's a platform. 301.94s - 306.28s | The most known one is OpenSea, that one with the ugly monkey. 307.26s - 311.14s | That was hacked several times, but it's not about this talk. 312.10s - 319.24s | This is a very big market, probably is whitelist for almost all Web3, you know, companies. 319.48s - 321.94s | All traffic go through this API. 322.12s - 325.44s | OK, but that is off-chain, too. 326.16s - 331.96s | It's partially stored in on-chain, I mean in the blockchain. 332.26s - 338.68s | But the metadata is decentralized in other places, like this file system is in another place. 339.18s - 346.74s | Now, this is very important when you use decentralized metadata, where it can be in many, many places. 346.74s - 351.28s | But here is specifically talk about interplanetary file system. 351.94s - 355.36s | I don't know if some everybody is familiar with this. 355.82s - 359.46s | It's a cool place, you know, very decentralized platforms. 359.72s - 367.68s | It's like torrent, you know, when you try to download or upload a file, a music there, you have seeds, no? 368.04s - 371.76s | So these seeds, everything is shared among these seeds. 372.16s - 380.12s | And when you have these, you hold these files and


chunk_text:
| That was hacked several times, but it's not about this talk. 312.10s - 319.24s | This is a very big market, probably is whitelist for almost all Web3, you know, companies. 319.48s - 321.94s | All traffic go through this API. 322.12s - 325.44s | OK, but that is off-chain, too. 326.16s - 331.96s | It's partially stored in on-chain, I mean in the blockchain. 332.26s - 338.68s | But the metadata is decentralized in other places, like this file system is in another place. 339.18s - 346.74s | Now, this is very important when you use decentralized metadata, where it can be in many, many places. 346.74s - 351.28s | But here is specifically talk about interplanetary file system. 351.94s - 355.36s | I don't know if some everybody is familiar with this. 355.82s - 359.46s | It's a cool place, you know, very decentralized platforms. 359.72s - 367.68s | It's like torrent, you know, when you try to download or upload a file, a music there, you have seeds, no? 368.04s - 371.76s | So these seeds, everything is shared among these seeds. 372.16s - 380.12s | And when you have these, you hold these files and you can share, you know, and hold these files. 380.16s - 381.84s | You have, you receive coins. 381.92s - 386.12s | I mean, you are paid, you know, to have these files. 386.46s - 393.78s | This is really nice for who's, you know, who have this, you have these files as a file coin, I guess the name. 393.82s - 394.66s | Yes, right. 396.14s - 401.30s | And then this image, when you upload there, is converted in another kind of file. 401.50s - 409.42s | This AVIF, I'm not so familiar with this kind of, you know, I'm not an artist to convert the images. 409.76s - 418.84s | And then the original file that's stored in this decentralized place is highly distributed among the seeds. 419.24s - 425.04s | And this is the thing, you know, everything is in the seeds, all these files. 425.16s - 431.00s | So starting from here is the thing, you know, what we're talking about. 431.20s - 435.32s | Please explain what we do with these files that are decentralized. 435.86s - 443.94s | Well, the point with the Interplanetary File System is that it's used widely by Lockheed


chunk_text:
you can share, you know, and hold these files. 380.16s - 381.84s | You have, you receive coins. 381.92s - 386.12s | I mean, you are paid, you know, to have these files. 386.46s - 393.78s | This is really nice for who's, you know, who have this, you have these files as a file coin, I guess the name. 393.82s - 394.66s | Yes, right. 396.14s - 401.30s | And then this image, when you upload there, is converted in another kind of file. 401.50s - 409.42s | This AVIF, I'm not so familiar with this kind of, you know, I'm not an artist to convert the images. 409.76s - 418.84s | And then the original file that's stored in this decentralized place is highly distributed among the seeds. 419.24s - 425.04s | And this is the thing, you know, everything is in the seeds, all these files. 425.16s - 431.00s | So starting from here is the thing, you know, what we're talking about. 431.20s - 435.32s | Please explain what we do with these files that are decentralized. 435.86s - 443.94s | Well, the point with the Interplanetary File System is that it's used widely by Lockheed Martin, IBM, other high vendors. 444.38s - 446.74s | The point is that everything is distributed. 446.78s - 448.54s | Anyone can run an APFS node. 449.02s - 454.02s | So if you want to take something down, you have to ask every single node owner to take it down. 454.46s - 462.34s | But as my partner here said, OpenSea and some other platforms reward you for holding the file or sharing the file with Filecoin. 462.60s - 467.08s | So if you get a hold of a file, everybody deletes it and you have it. 467.36s - 469.96s | There's a supply-demand problem here. 470.40s - 474.68s | You can make lots of money by being the last one, the last holder of that file. 475.20s - 482.56s | So that opens the path to certain kind of abuses of people not actually honoring takedown requests. 485.39s - 487.39s | Okay, so now comes the important part. 488.39s - 494.27s | This sounds pretty good in theory, but we have to make it into code, especially into Ruby code. 494.27s - 500.47s | So if any one of you knows Ruby, you know that it might be nice,


chunk_text:
Martin, IBM, other high vendors. 444.38s - 446.74s | The point is that everything is distributed. 446.78s - 448.54s | Anyone can run an APFS node. 449.02s - 454.02s | So if you want to take something down, you have to ask every single node owner to take it down. 454.46s - 462.34s | But as my partner here said, OpenSea and some other platforms reward you for holding the file or sharing the file with Filecoin. 462.60s - 467.08s | So if you get a hold of a file, everybody deletes it and you have it. 467.36s - 469.96s | There's a supply-demand problem here. 470.40s - 474.68s | You can make lots of money by being the last one, the last holder of that file. 475.20s - 482.56s | So that opens the path to certain kind of abuses of people not actually honoring takedown requests. 485.39s - 487.39s | Okay, so now comes the important part. 488.39s - 494.27s | This sounds pretty good in theory, but we have to make it into code, especially into Ruby code. 494.27s - 500.47s | So if any one of you knows Ruby, you know that it might be nice, but it's not as flexible as other languages. 500.55s - 512.59s | So what we need right now, we need a malicious C2 server, a malware that can interpret and send commands from NFTs, and obviously the malicious NFTs. 512.61s - 514.61s | I'm going to switch the mic. 515.09s - 517.09s | Okay, I'm back here. 517.49s - 523.37s | So for this experiment, we have Leopoldo. I presented him in the previous slides. 523.49s - 533.97s | We have four NFTs, which every single one does anything different, and we're going to test different attack vectors encoded inside these NFTs. 533.97s - 539.41s | We have Initial Access Marker, Ramson Retriever, Treat Actor, and Golden Locker, my personal favorite. 540.01s - 541.73s | It's not for sale. 541.73s - 547.09s | Okay, on the left, you can see the malware coded in Ruby called MFT, Malicious Fungible Tokens. 547.09s - 552.67s | And on the right side, you can see the C2 server coded once again in Ruby and Sinatra. 553.89s - 557.33s | Let's start by exploiting the most basic things in OpenSea. 557.89s - 560.93s | Let's start by exploiting the common fields, the low-hanging fruit.


chunk_text:
but it's not as flexible as other languages. 500.55s - 512.59s | So what we need right now, we need a malicious C2 server, a malware that can interpret and send commands from NFTs, and obviously the malicious NFTs. 512.61s - 514.61s | I'm going to switch the mic. 515.09s - 517.09s | Okay, I'm back here. 517.49s - 523.37s | So for this experiment, we have Leopoldo. I presented him in the previous slides. 523.49s - 533.97s | We have four NFTs, which every single one does anything different, and we're going to test different attack vectors encoded inside these NFTs. 533.97s - 539.41s | We have Initial Access Marker, Ramson Retriever, Treat Actor, and Golden Locker, my personal favorite. 540.01s - 541.73s | It's not for sale. 541.73s - 547.09s | Okay, on the left, you can see the malware coded in Ruby called MFT, Malicious Fungible Tokens. 547.09s - 552.67s | And on the right side, you can see the C2 server coded once again in Ruby and Sinatra. 553.89s - 557.33s | Let's start by exploiting the most basic things in OpenSea. 557.89s - 560.93s | Let's start by exploiting the common fields, the low-hanging fruit. 561.69s - 567.09s | Treat Actor, what it actually does, is has a description field publicly viewable by anyone. 567.25s - 571.93s | It's visible to anyone, which is encoded in Base64 and ROT13. 572.25s - 577.69s | When decoded, it says IP address, which is always hard-coded on all examples to local hosts, 577.85s - 580.61s | so you cannot do any damage to anyone else. 581.53s - 583.53s | It has a code 583.73s - 590.41s | parameter that actually represents UNIX command and actions, which are actually proprietary modules of the malware. 590.93s - 597.17s | This is not detected by CyberChef, even with magic on DEV10, so that was pretty awesome for me. 597.89s - 605.13s | Then we have Golden Locker, which has a description just encoded in Base64, which is not also discovered by 605.81s - 610.09s | CyberChef, and has other actions. We will see them in detail now. 611.05s - 614.41s | Here's the malware, and we will have a demo at the end of this talk. 615.01s - 622.17s | When you search for an account, for an ENS domain name or an Ethereum account, it will list all NFTs, 622.61s


chunk_text:
561.69s - 567.09s | Treat Actor, what it actually does, is has a description field publicly viewable by anyone. 567.25s - 571.93s | It's visible to anyone, which is encoded in Base64 and ROT13. 572.25s - 577.69s | When decoded, it says IP address, which is always hard-coded on all examples to local hosts, 577.85s - 580.61s | so you cannot do any damage to anyone else. 581.53s - 583.53s | It has a code 583.73s - 590.41s | parameter that actually represents UNIX command and actions, which are actually proprietary modules of the malware. 590.93s - 597.17s | This is not detected by CyberChef, even with magic on DEV10, so that was pretty awesome for me. 597.89s - 605.13s | Then we have Golden Locker, which has a description just encoded in Base64, which is not also discovered by 605.81s - 610.09s | CyberChef, and has other actions. We will see them in detail now. 611.05s - 614.41s | Here's the malware, and we will have a demo at the end of this talk. 615.01s - 622.17s | When you search for an account, for an ENS domain name or an Ethereum account, it will list all NFTs, 622.61s - 626.93s | showing the newer ones first, because if you are pricing Situ servers, 626.93s - 631.65s | this one will have the latest information that you need, the most up-to-date information and commands. 632.09s - 637.01s | Then, if you can see the contract and the description and the collection. 637.61s - 641.49s | And then, here's the thing. If you see the description, you will see the encoded 642.45s - 643.93s | payload. 643.93s - 649.13s | But if you see below, you will see the URL for the picture and the metadata, and then you'll go to 649.53s - 653.09s | IPFS.IO, and here you will say, Mauro, what happens if I 653.73s - 660.89s | send a takedown request to IPFS.IO? Absolutely nothing, because IPFS.IO is just an IPFS browser. 661.33s - 663.61s | All this information is stored on different 664.41s - 669.45s | IPSF nodes across the world, and you have to make a takedown request to every single one. 670.45s - 675.13s | Then, if any one of you is familiar with Terraform, 675.69s - 681.73s | actually, Terraform has a Terraform plan, which will show you what changes will happen before


chunk_text:
- 626.93s | showing the newer ones first, because if you are pricing Situ servers, 626.93s - 631.65s | this one will have the latest information that you need, the most up-to-date information and commands. 632.09s - 637.01s | Then, if you can see the contract and the description and the collection. 637.61s - 641.49s | And then, here's the thing. If you see the description, you will see the encoded 642.45s - 643.93s | payload. 643.93s - 649.13s | But if you see below, you will see the URL for the picture and the metadata, and then you'll go to 649.53s - 653.09s | IPFS.IO, and here you will say, Mauro, what happens if I 653.73s - 660.89s | send a takedown request to IPFS.IO? Absolutely nothing, because IPFS.IO is just an IPFS browser. 661.33s - 663.61s | All this information is stored on different 664.41s - 669.45s | IPSF nodes across the world, and you have to make a takedown request to every single one. 670.45s - 675.13s | Then, if any one of you is familiar with Terraform, 675.69s - 681.73s | actually, Terraform has a Terraform plan, which will show you what changes will happen before you push the button. 682.05s - 687.57s | So you can avoid something like, you know, a CrowdStrike incident and things like that. 688.41s - 692.77s | Actually, I tried to implement that. It's a function I'm super in love with. 693.01s - 698.65s | So the malware will tell you what's going to happen once you run that NFT. Will the code tell you step-by-step 698.65s - 701.69s | what's going to happen before you push the button? 702.57s - 709.13s | And then, you will see it running in action, as you can see here. They will say, okay, I'm using this server as a relay. 709.13s - 715.81s | I will run this custom code, WhoAmI, which answers back with Mauro Eldritch ID, which answers back with my ID, 716.37s - 721.49s | hostname, and so on. There are some fake functions that I have not coded in, 721.85s - 727.33s | obviously, for obvious reasons, that are wipe, encrypt, and open a reverse shell. That won't work at all. 728.69s - 732.69s | And this is what the attacker will see from the Sitio server. 733.13s - 738.69s | We'll see all the answers, for example,


chunk_text:
you push the button. 682.05s - 687.57s | So you can avoid something like, you know, a CrowdStrike incident and things like that. 688.41s - 692.77s | Actually, I tried to implement that. It's a function I'm super in love with. 693.01s - 698.65s | So the malware will tell you what's going to happen once you run that NFT. Will the code tell you step-by-step 698.65s - 701.69s | what's going to happen before you push the button? 702.57s - 709.13s | And then, you will see it running in action, as you can see here. They will say, okay, I'm using this server as a relay. 709.13s - 715.81s | I will run this custom code, WhoAmI, which answers back with Mauro Eldritch ID, which answers back with my ID, 716.37s - 721.49s | hostname, and so on. There are some fake functions that I have not coded in, 721.85s - 727.33s | obviously, for obvious reasons, that are wipe, encrypt, and open a reverse shell. That won't work at all. 728.69s - 732.69s | And this is what the attacker will see from the Sitio server. 733.13s - 738.69s | We'll see all the answers, for example, new exfiltration from localhost, and everything that happens. 738.69s - 745.25s | But let's see how it works in the back. Before exploiting this, which is a super low-hanging fruit, 745.77s - 749.85s | we will try to do something more complex. Remember that my partner told that 750.25s - 755.93s | once you send a picture to an NFT, it will be stored in ABIF format and decentralized. 756.17s - 761.53s | Well, the original file, the raw file, will be decentralized as well, for no apparent reason. 762.17s - 765.49s | So, that's where we can inject more shenanigans. 765.93s - 769.57s | In this case, I just wanted to test that the steganography will work. 769.57s - 776.01s | So, I put Mauro Eldritch was here. The method is the most simple method on steganography, less single bit or LSB, 776.93s - 780.05s | which has a hard-coded location that everyone knows. 781.05s - 786.69s | And then, if you see here, you have once again the picture URL and the metadata URL. 786.69s - 791.77s | Let's try to download the picture and check if the message made it to production on OpenSea. 792.77s - 798.65s


chunk_text:
new exfiltration from localhost, and everything that happens. 738.69s - 745.25s | But let's see how it works in the back. Before exploiting this, which is a super low-hanging fruit, 745.77s - 749.85s | we will try to do something more complex. Remember that my partner told that 750.25s - 755.93s | once you send a picture to an NFT, it will be stored in ABIF format and decentralized. 756.17s - 761.53s | Well, the original file, the raw file, will be decentralized as well, for no apparent reason. 762.17s - 765.49s | So, that's where we can inject more shenanigans. 765.93s - 769.57s | In this case, I just wanted to test that the steganography will work. 769.57s - 776.01s | So, I put Mauro Eldritch was here. The method is the most simple method on steganography, less single bit or LSB, 776.93s - 780.05s | which has a hard-coded location that everyone knows. 781.05s - 786.69s | And then, if you see here, you have once again the picture URL and the metadata URL. 786.69s - 791.77s | Let's try to download the picture and check if the message made it to production on OpenSea. 792.77s - 798.65s | And, for nobody's surprise, once downloaded and check it with setsteg, which is a third-party tool I do not own, 798.93s - 801.17s | you can see the message replicated. 801.77s - 804.73s | This means that we can decentralize messages, 805.33s - 809.29s | steganographic messages, across all the world of using OpenSea. 809.85s - 811.69s | Why is this so important? 811.69s - 818.13s | Because the malware will only send traffic to OpenSea API. 818.69s - 824.45s | So, when doing forensics on an affected device, you will see that the traffic and the attack comes from OpenSea, 824.89s - 826.85s | from nowhere else, just OpenSea. 827.21s - 831.73s | From Wireshark, from TCP DAM, you will see only connections to OpenSea API. 832.73s - 840.85s | And then, I decided to create, let's say, my master hardcraft, Initial Access Marker, which has all the attack vectors. 841.17s - 844.09s | It has steganographic signet messages. 844.41s - 849.29s | It has a trait, which is a common field on all NFTs. 849.57s - 854.49s | But it also has something called Exif field. 854.93s - 860.29s | Exif metadata is data that is usually


chunk_text:
| And, for nobody's surprise, once downloaded and check it with setsteg, which is a third-party tool I do not own, 798.93s - 801.17s | you can see the message replicated. 801.77s - 804.73s | This means that we can decentralize messages, 805.33s - 809.29s | steganographic messages, across all the world of using OpenSea. 809.85s - 811.69s | Why is this so important? 811.69s - 818.13s | Because the malware will only send traffic to OpenSea API. 818.69s - 824.45s | So, when doing forensics on an affected device, you will see that the traffic and the attack comes from OpenSea, 824.89s - 826.85s | from nowhere else, just OpenSea. 827.21s - 831.73s | From Wireshark, from TCP DAM, you will see only connections to OpenSea API. 832.73s - 840.85s | And then, I decided to create, let's say, my master hardcraft, Initial Access Marker, which has all the attack vectors. 841.17s - 844.09s | It has steganographic signet messages. 844.41s - 849.29s | It has a trait, which is a common field on all NFTs. 849.57s - 854.49s | But it also has something called Exif field. 854.93s - 860.29s | Exif metadata is data that is usually put by machines, by your processors, 860.57s - 863.21s | by your cameras, by your phones. 863.77s - 870.05s | The point is, the trick here is that, Exif metadata, it's hard to just put any arbitrary value in, you know? 870.77s - 874.49s | You can put numbers, you have certain fields that are more flexible than others. 875.01s - 880.97s | But there's a field, a specific field called profile copyright, that allows you to put basically anything you want without limit. 881.33s - 883.17s | And that's where it stores the payload as well. 884.05s - 889.89s | And once you check it, once you go to any IPFS browser, 890.29s - 895.61s | you will see that the trait is already distributed globally. 896.05s - 902.21s | So you can rely on the trait and not even start messing with metadata or messing with Exif metadata as well. 903.25s - 907.97s | But then, I say, OK, let's try if we can check the other two vectors. 908.45s - 911.97s | Downloading the picture that you can see here, which is hosted on IPFS.io, 913.13s - 919.49s | you can see that by running Exif tool


chunk_text:
put by machines, by your processors, 860.57s - 863.21s | by your cameras, by your phones. 863.77s - 870.05s | The point is, the trick here is that, Exif metadata, it's hard to just put any arbitrary value in, you know? 870.77s - 874.49s | You can put numbers, you have certain fields that are more flexible than others. 875.01s - 880.97s | But there's a field, a specific field called profile copyright, that allows you to put basically anything you want without limit. 881.33s - 883.17s | And that's where it stores the payload as well. 884.05s - 889.89s | And once you check it, once you go to any IPFS browser, 890.29s - 895.61s | you will see that the trait is already distributed globally. 896.05s - 902.21s | So you can rely on the trait and not even start messing with metadata or messing with Exif metadata as well. 903.25s - 907.97s | But then, I say, OK, let's try if we can check the other two vectors. 908.45s - 911.97s | Downloading the picture that you can see here, which is hosted on IPFS.io, 913.13s - 919.49s | you can see that by running Exif tool on the specific field, you will see once again the payload. 920.17s - 925.13s | Running SetStag will render once again the payload. 925.65s - 930.73s | So this adds different layers of resilience to store the same or different payloads on a simple NFT. 931.57s - 935.37s | Remember that minting an NFT is something super, absolutely cheap. 936.09s - 943.05s | So you can basically write immortal C2 servers for five pounds, seven dollars, or whatever is in your currency. 943.81s - 948.41s | You can also check this with different third-party tools I do not own to see that the payload is reflected. 949.49s - 952.65s | And now it's time to the demos. We are very good in time. 952.65s - 957.41s | The demos don't have sound, but you will enjoy my angel voice narrating it. 961.92s - 968.68s | This first example is, sorry, let's try to improve the quality because you deserve better. 971.73s - 980.86s | Give me a second. Basically, what we are going to do here is run GoldenLocker, 981.06s - 983.14s | one of the low-hanging fruit exploitation. 983.62s - 988.38s | Above you can see the malware and


chunk_text:
on the specific field, you will see once again the payload. 920.17s - 925.13s | Running SetStag will render once again the payload. 925.65s - 930.73s | So this adds different layers of resilience to store the same or different payloads on a simple NFT. 931.57s - 935.37s | Remember that minting an NFT is something super, absolutely cheap. 936.09s - 943.05s | So you can basically write immortal C2 servers for five pounds, seven dollars, or whatever is in your currency. 943.81s - 948.41s | You can also check this with different third-party tools I do not own to see that the payload is reflected. 949.49s - 952.65s | And now it's time to the demos. We are very good in time. 952.65s - 957.41s | The demos don't have sound, but you will enjoy my angel voice narrating it. 961.92s - 968.68s | This first example is, sorry, let's try to improve the quality because you deserve better. 971.73s - 980.86s | Give me a second. Basically, what we are going to do here is run GoldenLocker, 981.06s - 983.14s | one of the low-hanging fruit exploitation. 983.62s - 988.38s | Above you can see the malware and below you can see the C2 server. 988.78s - 992.66s | They are both running on the same machine in order to not damage anything. 993.26s - 995.42s | We'll try to decode the instructions. 995.86s - 1002.50s | The network is not cooperating, but we will try to decode instructions that are hosted on the malware. 1003.22s - 1008.76s | Give me a second, which belongs to GoldenLocker. 1010.52s - 1012.76s | It will then give us an action plan. 1013.24s - 1014.24s | Sorry about that. 1018.42s - 1021.22s | It will give us an action plan then, and what will happen? 1021.78s - 1028.26s | It will try to run WhoAmI, id, hostname, and will try to uniquely identify the host and do some other shenanigans. 1029.74s - 1031.18s | Then we need to execute it. 1031.86s - 1037.47s | Sorry. 1037.67s - 1039.27s | Hackers with tech problems. 1039.63s - 1040.63s | Happens. 1040.71s - 1042.03s | This happens from time to time, you know. 1047.66s - 1048.82s | We will try to run it again. 1055.27s - 1060.19s | The idea is to then execute it and see how the commands are reflected on the


chunk_text:
below you can see the C2 server. 988.78s - 992.66s | They are both running on the same machine in order to not damage anything. 993.26s - 995.42s | We'll try to decode the instructions. 995.86s - 1002.50s | The network is not cooperating, but we will try to decode instructions that are hosted on the malware. 1003.22s - 1008.76s | Give me a second, which belongs to GoldenLocker. 1010.52s - 1012.76s | It will then give us an action plan. 1013.24s - 1014.24s | Sorry about that. 1018.42s - 1021.22s | It will give us an action plan then, and what will happen? 1021.78s - 1028.26s | It will try to run WhoAmI, id, hostname, and will try to uniquely identify the host and do some other shenanigans. 1029.74s - 1031.18s | Then we need to execute it. 1031.86s - 1037.47s | Sorry. 1037.67s - 1039.27s | Hackers with tech problems. 1039.63s - 1040.63s | Happens. 1040.71s - 1042.03s | This happens from time to time, you know. 1047.66s - 1048.82s | We will try to run it again. 1055.27s - 1060.19s | The idea is to then execute it and see how the commands are reflected on the other server. 1060.59s - 1061.91s | Here it is trying to work. 1062.23s - 1063.39s | Give it some seconds. 1068.87s - 1072.39s | The quality is not the best, but let's try to bear with it. 1075.53s - 1079.37s | And then it tries to find a viable payload. 1079.49s - 1084.29s | If you see here, you will see that it says, I have found a tainted exif registry. 1084.45s - 1087.53s | I have found a tainted steganographic message that I can use. 1088.33s - 1094.49s | And if it will try to find the description first, it will try to then jump into something more complex each time 1094.89s - 1098.37s | in order to try to use the low-hungered fruit available first. 1099.89s - 1100.89s | Sorry, just. 1107.27s - 1112.87s | And then the idea, the final idea is that, as I said before, you will see all the traffic being reflected to OpenSea. 1113.55s - 1120.79s | That makes it actually difficult for forensic teams to know where the tanks come from, but also it will help them in another way. 1122.03s - 1128.99s | If any of you is a defender or


chunk_text:
other server. 1060.59s - 1061.91s | Here it is trying to work. 1062.23s - 1063.39s | Give it some seconds. 1068.87s - 1072.39s | The quality is not the best, but let's try to bear with it. 1075.53s - 1079.37s | And then it tries to find a viable payload. 1079.49s - 1084.29s | If you see here, you will see that it says, I have found a tainted exif registry. 1084.45s - 1087.53s | I have found a tainted steganographic message that I can use. 1088.33s - 1094.49s | And if it will try to find the description first, it will try to then jump into something more complex each time 1094.89s - 1098.37s | in order to try to use the low-hungered fruit available first. 1099.89s - 1100.89s | Sorry, just. 1107.27s - 1112.87s | And then the idea, the final idea is that, as I said before, you will see all the traffic being reflected to OpenSea. 1113.55s - 1120.79s | That makes it actually difficult for forensic teams to know where the tanks come from, but also it will help them in another way. 1122.03s - 1128.99s | If any of you is a defender or forensic analyst or similar, you will really appreciate the value of having 1129.83s - 1134.19s | basically immortal C2 server, because you will have an artifact that you can 1135.03s - 1138.67s | dissect and check basically forever and use as an example forever. 1139.03s - 1143.63s | You won't have to rely on malware libraries and you won't have to rely on, you know, 1144.55s - 1146.83s | platforms that simulate attacks on malware. 1148.51s - 1151.63s | Well, since this is not cooperating, I will move on. 1153.68s - 1155.96s | I'm sorry about that. Sometimes that happens. 1156.04s - 1159.88s | Sometimes it's not easy, but we'll move on. 1163.80s - 1169.80s | And as in all crypto experiments, there is something that you cannot just be safe from and are scammers. 1170.24s - 1176.32s | As soon as we publish it, the pictures of my golden retriever, I have people trying to buy it for 15th, 20th and so on. 1176.72s - 1179.28s | And let me tell you, it's not worth it. 1179.32s - 1182.68s | He showers once a month, so he smells like a seal. 1182.72s - 1183.72s | It's not worth it.


chunk_text:
forensic analyst or similar, you will really appreciate the value of having 1129.83s - 1134.19s | basically immortal C2 server, because you will have an artifact that you can 1135.03s - 1138.67s | dissect and check basically forever and use as an example forever. 1139.03s - 1143.63s | You won't have to rely on malware libraries and you won't have to rely on, you know, 1144.55s - 1146.83s | platforms that simulate attacks on malware. 1148.51s - 1151.63s | Well, since this is not cooperating, I will move on. 1153.68s - 1155.96s | I'm sorry about that. Sometimes that happens. 1156.04s - 1159.88s | Sometimes it's not easy, but we'll move on. 1163.80s - 1169.80s | And as in all crypto experiments, there is something that you cannot just be safe from and are scammers. 1170.24s - 1176.32s | As soon as we publish it, the pictures of my golden retriever, I have people trying to buy it for 15th, 20th and so on. 1176.72s - 1179.28s | And let me tell you, it's not worth it. 1179.32s - 1182.68s | He showers once a month, so he smells like a seal. 1182.72s - 1183.72s | It's not worth it. 1184.76s - 1192.40s | And then going back to the serious track, as I was discovering this and reporting these issues with IPFSIO, 1192.96s - 1196.12s | I started seeing some ads, promoted ads on Twitter. 1196.64s - 1198.12s | I refuse to call it X. 1199.32s - 1205.88s | If you look at the lower left corner of the post on the left, you will see that the source address is IPFSIO. 1206.36s - 1214.60s | Somebody is hosting a drainer campaign, a phishing campaign on IPFSIO, rendering it basically immortal, unable to be taken down. 1215.20s - 1220.40s | So it has a rent-free web server to host the campaign forever. 1221.32s - 1226.72s | Those are the dangers of decentralization when it's weaponized. 1229.24s - 1231.80s | And then, so I hope you enjoyed this talk. 1231.84s - 1232.92s | It's time to say goodbye. 1233.28s - 1235.20s | I know that you may have questions. 1235.60s - 1239.76s | This talk is not exactly about NFTs or blockchain in general, but rather how to end up using it. 1240.08s - 1240.96s | I hope you enjoyed it. 1240.96s - 1242.48s | Sorry for the demo not


chunk_text:
1184.76s - 1192.40s | And then going back to the serious track, as I was discovering this and reporting these issues with IPFSIO, 1192.96s - 1196.12s | I started seeing some ads, promoted ads on Twitter. 1196.64s - 1198.12s | I refuse to call it X. 1199.32s - 1205.88s | If you look at the lower left corner of the post on the left, you will see that the source address is IPFSIO. 1206.36s - 1214.60s | Somebody is hosting a drainer campaign, a phishing campaign on IPFSIO, rendering it basically immortal, unable to be taken down. 1215.20s - 1220.40s | So it has a rent-free web server to host the campaign forever. 1221.32s - 1226.72s | Those are the dangers of decentralization when it's weaponized. 1229.24s - 1231.80s | And then, so I hope you enjoyed this talk. 1231.84s - 1232.92s | It's time to say goodbye. 1233.28s - 1235.20s | I know that you may have questions. 1235.60s - 1239.76s | This talk is not exactly about NFTs or blockchain in general, but rather how to end up using it. 1240.08s - 1240.96s | I hope you enjoyed it. 1240.96s - 1242.48s | Sorry for the demo not working. 1242.48s - 1243.84s | I apologize, heartfelt. 1244.40s - 1245.92s | And well, thanks for coming. 1245.92s - 1246.80s | Thanks for your time. 1247.24s - 1248.60s | I really enjoy your company today. 1248.64s - 1249.72s | You can contact us here. 1253.20s - 1254.20s | Thank you, everyone. 1254.24s - 1257.64s | Any questions, comments, or something like this? 1258.36s - 1259.44s | The dog is not for sale. 1259.88s - 1262.52s | Did you release the tool? 1262.56s - 1263.56s | Yeah, the tool is released. 1263.72s - 1269.68s | You can actually create your own MetaMask address, jump to OpenSea, and start dealing with it. 1270.04s - 1272.20s | Feel free to fork it, change it, your call. 1273.92s - 1274.72s | Someone else? 1274.96s - 1275.72s | Questions? 1276.24s - 1276.88s | Comments? 1277.88s - 1278.40s | No? 1278.72s - 1280.84s | So, a quick advertisement. 1281.64s - 1283.92s | We are holding a new village here. 1284.20s - 1285.28s | It's La Villa Hacker. 1285.28s - 1289.20s | It's more focused on people who speak Spanish and Portuguese. 1289.20s - 1292.48s | We have awesome talks, all in Spanish and Portuguese. 1292.84s -


chunk_text:
working. 1242.48s - 1243.84s | I apologize, heartfelt. 1244.40s - 1245.92s | And well, thanks for coming. 1245.92s - 1246.80s | Thanks for your time. 1247.24s - 1248.60s | I really enjoy your company today. 1248.64s - 1249.72s | You can contact us here. 1253.20s - 1254.20s | Thank you, everyone. 1254.24s - 1257.64s | Any questions, comments, or something like this? 1258.36s - 1259.44s | The dog is not for sale. 1259.88s - 1262.52s | Did you release the tool? 1262.56s - 1263.56s | Yeah, the tool is released. 1263.72s - 1269.68s | You can actually create your own MetaMask address, jump to OpenSea, and start dealing with it. 1270.04s - 1272.20s | Feel free to fork it, change it, your call. 1273.92s - 1274.72s | Someone else? 1274.96s - 1275.72s | Questions? 1276.24s - 1276.88s | Comments? 1277.88s - 1278.40s | No? 1278.72s - 1280.84s | So, a quick advertisement. 1281.64s - 1283.92s | We are holding a new village here. 1284.20s - 1285.28s | It's La Villa Hacker. 1285.28s - 1289.20s | It's more focused on people who speak Spanish and Portuguese. 1289.20s - 1292.48s | We have awesome talks, all in Spanish and Portuguese. 1292.84s - 1294.96s | If you want to visit us, it would be awesome. 1295.00s - 1296.76s | And thank you very much, guys. 1297.36s - 1297.84s | Thank you.


chunk_text:
1294.96s | If you want to visit us, it would be awesome. 1295.00s - 1296.76s | And thank you very much, guys. 1297.36s - 1297.84s | Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=xcbKIWXThT4", "title": "DEF CON 32 - Master Splinter\u2019s initial physical access dojo - Daniel Isler", "description": "Storytelling of a highly complex Red Team with multiple initial accesses only with Social Engineering. could anyone do it? Yes.\n\nUnder the format of Storytelling this presentation aims to take attendees first person through a RedTeam service with multiple initial accesses with 100% Social Engineering. How to present critical vulnerabilities in a public way without exposing the target company? This live comic will show us how, through one of its protagonists and with practical examples made with the attendees themselves. How does a professional Social Engineering unit work? What are the roles and tasks? How to emulate the reach of a cybercriminal gang in less than three weeks? This dojo aims to show the methodologies and techniques applied in the field to obtain relevant findings, even reaching critical infrastructure without raising alerts and in an extremely limited time. From the first meeting with the client, information gathering, vector selection, exploitation, pretexting to the physical intrusion, even reaching the datacenter. We will demonstrate how luck is no longer an element to consider when your work is SE from Monday to Friday and you have to perform this type of service every month.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1473, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.30s | This text was transcribed using whisper model: large-v2 Okay, welcome everybody. 2.30s - 4.74s | So if you're like me and you grew up with the Ninja Turtles, 4.74s - 6.74s | you're gonna be really excited about this one. 6.74s - 10.98s | We've got Daniel Eisler on behalf of Adversary Village, 10.98s - 13.78s | Master Splinter's Initial Physical Access Dojo, 13.78s - 16.66s | Storytelling of Complex Adversarial. 16.66s - 24.28s | Thanks so much and here we go. 24.28s - 27.02s | Hi, maybe most of you don't know me. 27.02s - 31.98s | And as you can see, I don't speak very well English. 32.14s - 35.18s | So I hope you enjoy this talk. 35.18s - 38.32s | Before I start, well, you already see it, 38.32s - 80.34s | but it's important this very first announce. 80.34s - 83.30s | Welcome, I am the Master Splinter. 83.30s - 86.58s | And no, I'm not coming from the Comic Con. 86.58s - 90.94s | You can call me Rad, Splinter, Danny,


chunk_text:
to perform this type of service every month.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1473, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 2.30s | This text was transcribed using whisper model: large-v2 Okay, welcome everybody. 2.30s - 4.74s | So if you're like me and you grew up with the Ninja Turtles, 4.74s - 6.74s | you're gonna be really excited about this one. 6.74s - 10.98s | We've got Daniel Eisler on behalf of Adversary Village, 10.98s - 13.78s | Master Splinter's Initial Physical Access Dojo, 13.78s - 16.66s | Storytelling of Complex Adversarial. 16.66s - 24.28s | Thanks so much and here we go. 24.28s - 27.02s | Hi, maybe most of you don't know me. 27.02s - 31.98s | And as you can see, I don't speak very well English. 32.14s - 35.18s | So I hope you enjoy this talk. 35.18s - 38.32s | Before I start, well, you already see it, 38.32s - 80.34s | but it's important this very first announce. 80.34s - 83.30s | Welcome, I am the Master Splinter. 83.30s - 86.58s | And no, I'm not coming from the Comic Con. 86.58s - 90.94s | You can call me Rad, Splinter, Danny, or Daniel. 91.94s - 93.02s | Oh, awesome. 93.02s - 93.84s | Hello, hello. 95.32s - 96.72s | Okay. 96.72s - 97.56s | Yeah, yeah. 98.52s - 103.16s | Since 2015, I'm the team leader of Friendly Rats, 103.16s - 104.66s | the social engineering unit 104.66s - 106.74s | at DreamLab Technologies in Chile. 108.30s - 109.80s | Friendly Rats, DreamLab. 110.94s - 113.24s | I have the honor to present several cons. 113.24s - 115.54s | I don't know if you, you hear me? 115.54s - 116.64s | No, not too much. 117.48s - 118.68s | Yeah. 118.68s - 120.94s | I, okay, that's it. 122.72s - 125.52s | Several cons associated with social engineering, 125.54s - 129.36s | such as Ecoparty in Buenos Aires, Argentina, 130.46s - 133.36s | Osintomatico in Madrid, in Spain, 133.36s - 136.26s | Layer 8 in Rhode Island. 136.26s - 139.72s | And with a lot of nervous and joy, 139.72s - 144.44s | I will be, now is my fifth time presenting at DEFCON. 144.44s - 147.10s | So thank you, Adversary Village. 148.70s - 153.38s | Today, I'm gonna need the help of two volunteers 153.44s - 156.70s | who


chunk_text:
or Daniel. 91.94s - 93.02s | Oh, awesome. 93.02s - 93.84s | Hello, hello. 95.32s - 96.72s | Okay. 96.72s - 97.56s | Yeah, yeah. 98.52s - 103.16s | Since 2015, I'm the team leader of Friendly Rats, 103.16s - 104.66s | the social engineering unit 104.66s - 106.74s | at DreamLab Technologies in Chile. 108.30s - 109.80s | Friendly Rats, DreamLab. 110.94s - 113.24s | I have the honor to present several cons. 113.24s - 115.54s | I don't know if you, you hear me? 115.54s - 116.64s | No, not too much. 117.48s - 118.68s | Yeah. 118.68s - 120.94s | I, okay, that's it. 122.72s - 125.52s | Several cons associated with social engineering, 125.54s - 129.36s | such as Ecoparty in Buenos Aires, Argentina, 130.46s - 133.36s | Osintomatico in Madrid, in Spain, 133.36s - 136.26s | Layer 8 in Rhode Island. 136.26s - 139.72s | And with a lot of nervous and joy, 139.72s - 144.44s | I will be, now is my fifth time presenting at DEFCON. 144.44s - 147.10s | So thank you, Adversary Village. 148.70s - 153.38s | Today, I'm gonna need the help of two volunteers 153.44s - 156.70s | who wants to be real rats, ninja rats. 156.70s - 161.54s | So to be more faster, I have, 161.54s - 164.18s | no, no, but raise your hand, two persons. 164.18s - 167.08s | I have one, two, okay. 167.08s - 168.52s | Thank you, buddy. 168.52s - 170.52s | No, no, but I will call you. 170.52s - 171.62s | Thanks, thanks. 171.62s - 173.12s | Don't go. 173.12s - 181.32s | So welcome to the dojo. 181.32s - 183.62s | Okay, all rats are welcome. 183.64s - 186.84s | I could assure that everyone here 186.84s - 190.58s | has social engineering success story. 190.58s - 192.48s | I'm sure you're treasure it, 194.12s - 197.82s | even share it as an accomplishment or an adventure. 197.82s - 201.30s | In fact, I love to hear that stories after this 201.30s - 203.40s | with a beer, if you like. 203.40s - 206.60s | Now, I invite you to imagine that. 206.60s - 210.90s | Not the beer, the story of social engineering. 210.92s - 215.92s | And imagine that like a day job, like us, 217.06s - 219.76s | Monday through Friday, all year long. 219.76s -


chunk_text:
wants to be real rats, ninja rats. 156.70s - 161.54s | So to be more faster, I have, 161.54s - 164.18s | no, no, but raise your hand, two persons. 164.18s - 167.08s | I have one, two, okay. 167.08s - 168.52s | Thank you, buddy. 168.52s - 170.52s | No, no, but I will call you. 170.52s - 171.62s | Thanks, thanks. 171.62s - 173.12s | Don't go. 173.12s - 181.32s | So welcome to the dojo. 181.32s - 183.62s | Okay, all rats are welcome. 183.64s - 186.84s | I could assure that everyone here 186.84s - 190.58s | has social engineering success story. 190.58s - 192.48s | I'm sure you're treasure it, 194.12s - 197.82s | even share it as an accomplishment or an adventure. 197.82s - 201.30s | In fact, I love to hear that stories after this 201.30s - 203.40s | with a beer, if you like. 203.40s - 206.60s | Now, I invite you to imagine that. 206.60s - 210.90s | Not the beer, the story of social engineering. 210.92s - 215.92s | And imagine that like a day job, like us, 217.06s - 219.76s | Monday through Friday, all year long. 219.76s - 223.54s | That's why our first adage will be, 223.54s - 226.78s | there's no such a thing as luck. 226.78s - 230.30s | I don't know if you can say that in Vegas, 230.30s - 233.08s | but we don't trust in luck. 236.04s - 239.28s | What I will try to do today is to share with you 239.30s - 242.70s | how training, preparation, techniques and methods 242.70s - 246.44s | can help in a social engineering service or in a red team. 246.44s - 250.54s | So you can finally decide if luck really exists or not. 250.54s - 253.82s | It's difficult to make an eye-catching story 253.82s - 258.72s | when it has only existed in a report format. 258.72s - 261.92s | As you will see, I will do my best. 263.46s - 267.76s | So, it all starts in another country 267.78s - 272.78s | with a critical infrastructure company of that nation. 273.92s - 275.42s | We never expect to meet a client 275.42s - 278.46s | who is really willing to give us a clue 279.50s - 282.06s | as to what we are going to face. 282.06s - 285.96s


chunk_text:
223.54s | That's why our first adage will be, 223.54s - 226.78s | there's no such a thing as luck. 226.78s - 230.30s | I don't know if you can say that in Vegas, 230.30s - 233.08s | but we don't trust in luck. 236.04s - 239.28s | What I will try to do today is to share with you 239.30s - 242.70s | how training, preparation, techniques and methods 242.70s - 246.44s | can help in a social engineering service or in a red team. 246.44s - 250.54s | So you can finally decide if luck really exists or not. 250.54s - 253.82s | It's difficult to make an eye-catching story 253.82s - 258.72s | when it has only existed in a report format. 258.72s - 261.92s | As you will see, I will do my best. 263.46s - 267.76s | So, it all starts in another country 267.78s - 272.78s | with a critical infrastructure company of that nation. 273.92s - 275.42s | We never expect to meet a client 275.42s - 278.46s | who is really willing to give us a clue 279.50s - 282.06s | as to what we are going to face. 282.06s - 285.96s | He just point us to a few possible locations 285.96s - 287.66s | where they might be found. 288.64s - 291.54s | Control rooms, sorry, control rooms, 291.54s - 296.54s | monitoring rooms, machine rooms, offices and data center. 298.22s - 303.22s | One of the first thing we found in the assessment stage 304.88s - 309.88s | was that due to the type of service this client provide, 310.48s - 314.06s | in the case of any unusual activity 314.06s - 318.86s | or unauthorized personnel, the collaborators, 318.86s - 323.14s | any of them were authorized to reduce 323.14s - 325.94s | or at least detain the intruder 325.96s - 329.92s | until certain forces arrived. 333.56s - 336.96s | We start the first week with information gathering, 336.96s - 343.21s | focusing in the following three findings. 343.21s - 345.13s | Corporate ID. 345.13s - 347.73s | Thanks to a post in social networks, 347.73s - 352.73s | we found a 3.2 feet long version of the corporate ID 353.01s - 357.03s | with the personal ID of each of one of the developers. 358.41s - 361.77s | The second one was relevant profiles 361.77s -


chunk_text:
| He just point us to a few possible locations 285.96s - 287.66s | where they might be found. 288.64s - 291.54s | Control rooms, sorry, control rooms, 291.54s - 296.54s | monitoring rooms, machine rooms, offices and data center. 298.22s - 303.22s | One of the first thing we found in the assessment stage 304.88s - 309.88s | was that due to the type of service this client provide, 310.48s - 314.06s | in the case of any unusual activity 314.06s - 318.86s | or unauthorized personnel, the collaborators, 318.86s - 323.14s | any of them were authorized to reduce 323.14s - 325.94s | or at least detain the intruder 325.96s - 329.92s | until certain forces arrived. 333.56s - 336.96s | We start the first week with information gathering, 336.96s - 343.21s | focusing in the following three findings. 343.21s - 345.13s | Corporate ID. 345.13s - 347.73s | Thanks to a post in social networks, 347.73s - 352.73s | we found a 3.2 feet long version of the corporate ID 353.01s - 357.03s | with the personal ID of each of one of the developers. 358.41s - 361.77s | The second one was relevant profiles 361.77s - 364.13s | with exposed information. 364.13s - 369.13s | We identified four strategic collaborators account 369.37s - 374.37s | for identity impersonation and possible authorizations. 375.65s - 380.65s | And the third one was weak accesses and credentials. 380.73s - 383.41s | We found an internal login 383.41s - 385.89s | without two-factor authentication 385.91s - 389.59s | with the possibility of several consecutive attempts 389.59s - 392.05s | to enter wrong credentials. 392.05s - 396.97s | So maybe some, you know what happened with that. 398.11s - 400.77s | The human, humans, sorry. 401.63s - 406.63s | At this stage, it's very important to consider 407.23s - 411.27s | as burned the rat performing the interaction 411.27s - 414.03s | in the field for information gathering. 414.03s - 417.25s | He can't be part of the physical intrusion 417.25s - 421.17s | because collaborators could recognize him or her. 422.57s - 426.69s | This phase allows us to achieve two findings. 426.69s - 431.33s | First, the ID and the uniform design. 431.33s - 434.25s | We validated the design was the same 434.25s - 439.01s | as the one we found in the publication, in the post. 439.01s


chunk_text:
364.13s | with exposed information. 364.13s - 369.13s | We identified four strategic collaborators account 369.37s - 374.37s | for identity impersonation and possible authorizations. 375.65s - 380.65s | And the third one was weak accesses and credentials. 380.73s - 383.41s | We found an internal login 383.41s - 385.89s | without two-factor authentication 385.91s - 389.59s | with the possibility of several consecutive attempts 389.59s - 392.05s | to enter wrong credentials. 392.05s - 396.97s | So maybe some, you know what happened with that. 398.11s - 400.77s | The human, humans, sorry. 401.63s - 406.63s | At this stage, it's very important to consider 407.23s - 411.27s | as burned the rat performing the interaction 411.27s - 414.03s | in the field for information gathering. 414.03s - 417.25s | He can't be part of the physical intrusion 417.25s - 421.17s | because collaborators could recognize him or her. 422.57s - 426.69s | This phase allows us to achieve two findings. 426.69s - 431.33s | First, the ID and the uniform design. 431.33s - 434.25s | We validated the design was the same 434.25s - 439.01s | as the one we found in the publication, in the post. 439.01s - 443.21s | Second one, we want to check if indeed 443.21s - 445.81s | the attitude of the cats, 449.03s - 452.99s | if one of us perform an inappropriate action. 452.99s - 457.99s | So the burned rat took a picture of one of the accesses. 461.31s - 463.99s | In less than two minutes, 463.99s - 466.75s | he had one of the cats on his back, 466.75s - 468.51s | almost breaking the camera 468.51s - 470.67s | and demanding to delete the picture. 470.67s - 472.39s | So it's gonna be tough. 474.07s - 476.27s | How we organize in our unit? 477.27s - 479.65s | To deal with any type of service, 479.65s - 481.61s | we use the following distribution. 482.83s - 485.79s | We have four kind of consultants. 485.79s - 490.19s | Support, they are the ones who will immediately respond 490.19s - 492.99s | to all the requests needed by the alpha team, 492.99s - 497.31s | like information, supplies, mobilization, 497.31s - 499.67s | buy some stuff, et cetera. 499.67s - 502.23s | The queue, like the queue agent. 502.25s - 504.77s | They are in charge for preparation


chunk_text:
- 443.21s | Second one, we want to check if indeed 443.21s - 445.81s | the attitude of the cats, 449.03s - 452.99s | if one of us perform an inappropriate action. 452.99s - 457.99s | So the burned rat took a picture of one of the accesses. 461.31s - 463.99s | In less than two minutes, 463.99s - 466.75s | he had one of the cats on his back, 466.75s - 468.51s | almost breaking the camera 468.51s - 470.67s | and demanding to delete the picture. 470.67s - 472.39s | So it's gonna be tough. 474.07s - 476.27s | How we organize in our unit? 477.27s - 479.65s | To deal with any type of service, 479.65s - 481.61s | we use the following distribution. 482.83s - 485.79s | We have four kind of consultants. 485.79s - 490.19s | Support, they are the ones who will immediately respond 490.19s - 492.99s | to all the requests needed by the alpha team, 492.99s - 497.31s | like information, supplies, mobilization, 497.31s - 499.67s | buy some stuff, et cetera. 499.67s - 502.23s | The queue, like the queue agent. 502.25s - 504.77s | They are in charge for preparation devices, 504.77s - 509.77s | payloads, scripts, wifi, malicious webpage, et cetera. 510.81s - 515.25s | Then the alpha can be one or an alpha team. 515.25s - 518.23s | There are experts in exploitation, execution, 518.23s - 521.05s | capture, cloning and exfiltration, 521.05s - 523.29s | recovery and access enabling. 524.17s - 528.17s | And the last one, anyone here, 528.17s - 530.61s | you could be one of these ones today. 531.59s - 533.39s | Cover. 533.39s - 536.63s | We work with freelance consultants, 536.63s - 541.63s | from psychologists to actors, dogs to elderly people. 541.99s - 546.07s | We use, one time my son used to work too, 546.07s - 547.35s | with five years old. 548.47s - 550.91s | The resorts are always good, 550.91s - 554.75s | as they are not emotionally charged or stressed 554.75s - 556.73s | about the success of the service. 557.55s - 561.19s | The comments, their comments are usually, 561.19s - 564.23s | this is the most fun I ever had, 564.23s - 569.23s | or I wouldn't have imagined it will be so easy. 571.71s - 573.67s | When they say that, 573.67s - 577.39s


chunk_text:
devices, 504.77s - 509.77s | payloads, scripts, wifi, malicious webpage, et cetera. 510.81s - 515.25s | Then the alpha can be one or an alpha team. 515.25s - 518.23s | There are experts in exploitation, execution, 518.23s - 521.05s | capture, cloning and exfiltration, 521.05s - 523.29s | recovery and access enabling. 524.17s - 528.17s | And the last one, anyone here, 528.17s - 530.61s | you could be one of these ones today. 531.59s - 533.39s | Cover. 533.39s - 536.63s | We work with freelance consultants, 536.63s - 541.63s | from psychologists to actors, dogs to elderly people. 541.99s - 546.07s | We use, one time my son used to work too, 546.07s - 547.35s | with five years old. 548.47s - 550.91s | The resorts are always good, 550.91s - 554.75s | as they are not emotionally charged or stressed 554.75s - 556.73s | about the success of the service. 557.55s - 561.19s | The comments, their comments are usually, 561.19s - 564.23s | this is the most fun I ever had, 564.23s - 569.23s | or I wouldn't have imagined it will be so easy. 571.71s - 573.67s | When they say that, 573.67s - 577.39s | I start to see the hateful faces of the rats. 577.39s - 581.95s | So I explained them that it looks easy, 581.95s - 584.91s | thanks to the hard work of all the rats. 584.93s - 588.85s | That's why they managed to get inside the data center, 588.85s - 593.49s | manager's office or implant a device in a critical area. 593.49s - 596.33s | So now you know our team. 597.47s - 601.21s | So this was the plan or the organization. 601.21s - 603.53s | The uniform used by the cats 603.53s - 606.85s | was not available for sale to public. 606.85s - 611.85s | So our custom designer made her own research 613.13s - 614.49s | to generate replicas. 615.07s - 617.11s | So yes, we have a custom designer. 618.19s - 622.43s | As you can see, it is necessary for the details, 622.43s - 627.43s | including the natural aging and soiling of each uniform. 628.75s - 633.75s | You can't always buy online or trust online stores. 636.91s - 640.95s | This always happen when you buy online stores a uniform. 640.95s - 642.55s | So don't do it. 643.45s


chunk_text:
| I start to see the hateful faces of the rats. 577.39s - 581.95s | So I explained them that it looks easy, 581.95s - 584.91s | thanks to the hard work of all the rats. 584.93s - 588.85s | That's why they managed to get inside the data center, 588.85s - 593.49s | manager's office or implant a device in a critical area. 593.49s - 596.33s | So now you know our team. 597.47s - 601.21s | So this was the plan or the organization. 601.21s - 603.53s | The uniform used by the cats 603.53s - 606.85s | was not available for sale to public. 606.85s - 611.85s | So our custom designer made her own research 613.13s - 614.49s | to generate replicas. 615.07s - 617.11s | So yes, we have a custom designer. 618.19s - 622.43s | As you can see, it is necessary for the details, 622.43s - 627.43s | including the natural aging and soiling of each uniform. 628.75s - 633.75s | You can't always buy online or trust online stores. 636.91s - 640.95s | This always happen when you buy online stores a uniform. 640.95s - 642.55s | So don't do it. 643.45s - 645.51s | Found a custom designer. 646.89s - 649.45s | So what gonna do the Alpha team? 649.45s - 653.33s | They gonna dress like a central office collaborator. 653.33s - 656.37s | They will show up under the pretext 656.37s - 661.37s | of undertaking a review of sanitization protocols 662.93s - 665.37s | associated with COVID-19. 665.37s - 672.13s | Of course, this project took place in that time. 672.13s - 676.83s | Q, during the second week, our Q guys 678.87s - 683.11s | focus on four strategic profile email accounts. 683.11s - 688.11s | Probably everyone is familiar with this kind of tools. 689.59s - 694.59s | Who doesn't know, you can customize password dictionaries 694.71s - 697.55s | for brute force attack. 697.55s - 702.55s | So we achieve an effective access for four accounts 702.57s - 704.97s | thanks to the low restrictions 704.97s - 706.91s | on the weak password settings. 708.45s - 710.97s | Those were the results. 710.97s - 715.97s | So nothing very complex for these critical accounts. 717.87s - 720.27s | What gonna make support? 720.27s - 723.37s | Once inside of the email account, 723.37s - 726.53s


chunk_text:
- 645.51s | Found a custom designer. 646.89s - 649.45s | So what gonna do the Alpha team? 649.45s - 653.33s | They gonna dress like a central office collaborator. 653.33s - 656.37s | They will show up under the pretext 656.37s - 661.37s | of undertaking a review of sanitization protocols 662.93s - 665.37s | associated with COVID-19. 665.37s - 672.13s | Of course, this project took place in that time. 672.13s - 676.83s | Q, during the second week, our Q guys 678.87s - 683.11s | focus on four strategic profile email accounts. 683.11s - 688.11s | Probably everyone is familiar with this kind of tools. 689.59s - 694.59s | Who doesn't know, you can customize password dictionaries 694.71s - 697.55s | for brute force attack. 697.55s - 702.55s | So we achieve an effective access for four accounts 702.57s - 704.97s | thanks to the low restrictions 704.97s - 706.91s | on the weak password settings. 708.45s - 710.97s | Those were the results. 710.97s - 715.97s | So nothing very complex for these critical accounts. 717.87s - 720.27s | What gonna make support? 720.27s - 723.37s | Once inside of the email account, 723.37s - 726.53s | we blacklist or spam all the people 726.53s - 728.77s | where we are going to contact. 729.55s - 732.99s | Support team should permanently check the spam mailbox. 732.99s - 736.91s | And if they receive an email from one of these contacts, 736.91s - 738.61s | respond as soon as possible 738.61s - 742.07s | and delete both the spam email and the sent email. 742.07s - 744.05s | So it's invisible for the user. 747.83s - 750.63s | And another lethal weapon that we have, 753.19s - 756.51s | it will seem maybe absurd for you, 756.51s - 760.89s | but we register the phone number of our team 760.89s - 765.33s | with the name of the user of the compromised email account. 765.33s - 770.33s | So the phone call will be displayed the name in the screen. 773.41s - 776.41s | I know it sounds basic, but believe me, 776.41s - 779.95s | in a real scenario, it can save everything. 781.73s - 786.73s | Cover, few days before the execution, 786.75s - 791.23s | we sent on a script, a manual on protocols 791.23s - 794.03s | on preventive measures for COVID-19


chunk_text:
| we blacklist or spam all the people 726.53s - 728.77s | where we are going to contact. 729.55s - 732.99s | Support team should permanently check the spam mailbox. 732.99s - 736.91s | And if they receive an email from one of these contacts, 736.91s - 738.61s | respond as soon as possible 738.61s - 742.07s | and delete both the spam email and the sent email. 742.07s - 744.05s | So it's invisible for the user. 747.83s - 750.63s | And another lethal weapon that we have, 753.19s - 756.51s | it will seem maybe absurd for you, 756.51s - 760.89s | but we register the phone number of our team 760.89s - 765.33s | with the name of the user of the compromised email account. 765.33s - 770.33s | So the phone call will be displayed the name in the screen. 773.41s - 776.41s | I know it sounds basic, but believe me, 776.41s - 779.95s | in a real scenario, it can save everything. 781.73s - 786.73s | Cover, few days before the execution, 786.75s - 791.23s | we sent on a script, a manual on protocols 791.23s - 794.03s | on preventive measures for COVID-19 794.03s - 796.19s | to our covering consultant. 797.55s - 802.55s | As a guideline, he were to be 100% focused on coverage. 803.51s - 808.51s | That is lead conversation, initiate presentations 808.51s - 810.91s | and argue about our presence, 810.91s - 817.18s | perform distraction actions to support the alpha team. 817.18s - 820.76s | So in the preparation day, we met with the rats 820.76s - 824.30s | to review objectives and all relevant information. 824.30s - 829.30s | Names, position, contacts, roles, custom props, 830.46s - 834.72s | technical language, pretext, possible situations, 834.72s - 836.50s | issues and solutions. 837.60s - 842.60s | And the last added value, it's a powerful weapon. 842.94s - 847.94s | More than the phone, a nice but lethal sticker 848.74s - 853.74s | for each collaborator who was going to interact with us 853.80s - 855.20s | during the activity. 855.20s - 859.00s | That is a principle of reciprocity, it's so strong. 860.06s - 863.72s | So let's start, execution day. 864.58s - 867.94s | Support team, two consultants, one in the field 867.96s - 872.96s | and other remotely managing respectively the email account 874.76s -


chunk_text:
794.03s - 796.19s | to our covering consultant. 797.55s - 802.55s | As a guideline, he were to be 100% focused on coverage. 803.51s - 808.51s | That is lead conversation, initiate presentations 808.51s - 810.91s | and argue about our presence, 810.91s - 817.18s | perform distraction actions to support the alpha team. 817.18s - 820.76s | So in the preparation day, we met with the rats 820.76s - 824.30s | to review objectives and all relevant information. 824.30s - 829.30s | Names, position, contacts, roles, custom props, 830.46s - 834.72s | technical language, pretext, possible situations, 834.72s - 836.50s | issues and solutions. 837.60s - 842.60s | And the last added value, it's a powerful weapon. 842.94s - 847.94s | More than the phone, a nice but lethal sticker 848.74s - 853.74s | for each collaborator who was going to interact with us 853.80s - 855.20s | during the activity. 855.20s - 859.00s | That is a principle of reciprocity, it's so strong. 860.06s - 863.72s | So let's start, execution day. 864.58s - 867.94s | Support team, two consultants, one in the field 867.96s - 872.96s | and other remotely managing respectively the email account 874.76s - 879.76s | and a telephone to impersonate the user profile. 881.22s - 884.96s | The alpha team was composed of two consultants, 884.96s - 889.40s | a cover consultant who will pretend to be our boss 889.40s - 891.08s | and two other alpha. 892.44s - 895.64s | We arrive in the first access. 895.64s - 897.90s | The alpha team identified itself 897.90s - 900.38s | as a corporate office staff. 900.38s - 903.18s | With technical language, we speak with the guard 903.18s - 907.90s | ending with, don't worry, we already know the facility. 907.90s - 912.02s | The guard revealed allows us access 912.02s - 915.14s | upon seeing our uniforms and credentials. 915.14s - 917.86s | So it is important to understand 917.86s - 921.06s | that once you are a interlocutor 921.06s - 924.46s | that considers you trusty person 924.46s - 929.58s | or better yet, someone who can resolve situation. 929.58s - 931.14s | Yeah, yeah. 931.14s - 934.74s | Then you're standing in a privileged place. 934.74s - 938.10s | The guard looked at us with appreciation 938.10s - 944.40s | and announced over the radio that we were going on


chunk_text:
879.76s | and a telephone to impersonate the user profile. 881.22s - 884.96s | The alpha team was composed of two consultants, 884.96s - 889.40s | a cover consultant who will pretend to be our boss 889.40s - 891.08s | and two other alpha. 892.44s - 895.64s | We arrive in the first access. 895.64s - 897.90s | The alpha team identified itself 897.90s - 900.38s | as a corporate office staff. 900.38s - 903.18s | With technical language, we speak with the guard 903.18s - 907.90s | ending with, don't worry, we already know the facility. 907.90s - 912.02s | The guard revealed allows us access 912.02s - 915.14s | upon seeing our uniforms and credentials. 915.14s - 917.86s | So it is important to understand 917.86s - 921.06s | that once you are a interlocutor 921.06s - 924.46s | that considers you trusty person 924.46s - 929.58s | or better yet, someone who can resolve situation. 929.58s - 931.14s | Yeah, yeah. 931.14s - 934.74s | Then you're standing in a privileged place. 934.74s - 938.10s | The guard looked at us with appreciation 938.10s - 944.40s | and announced over the radio that we were going on our own. 944.40s - 949.16s | Okay, upon entering, we found ourselves in a maze. 950.24s - 953.04s | We knew we didn't have to look like strangers 953.04s - 954.78s | so we keep walking naturally. 955.74s - 958.02s | We walk through several corridors 958.02s - 960.30s | until we research a security door 960.30s - 962.02s | with proximity card opening 962.02s - 964.78s | with two factors of authentication. 964.78s - 969.54s | We stop in front of the access simulating a conversation 969.54s - 972.42s | until a cat appeared. 972.42s - 977.42s | A maintenance technician carrying a large number of boxes. 978.20s - 983.20s | So we obviously very kindly help him to open the door. 984.90s - 989.66s | On the other side was an armed guard cat 989.66s - 993.10s | who saw us in complicity with the technician 993.10s - 995.74s | plus the uniforms and credentials. 996.70s - 1000.38s | He went from the angry cat gesture, you know, 1000.38s - 1005.38s | as a simple raised eyebrow of a cat who had just eaten. 1009.71s - 1012.19s | So we advanced through the corridors, 1012.19s - 1017.19s |


chunk_text:
our own. 944.40s - 949.16s | Okay, upon entering, we found ourselves in a maze. 950.24s - 953.04s | We knew we didn't have to look like strangers 953.04s - 954.78s | so we keep walking naturally. 955.74s - 958.02s | We walk through several corridors 958.02s - 960.30s | until we research a security door 960.30s - 962.02s | with proximity card opening 962.02s - 964.78s | with two factors of authentication. 964.78s - 969.54s | We stop in front of the access simulating a conversation 969.54s - 972.42s | until a cat appeared. 972.42s - 977.42s | A maintenance technician carrying a large number of boxes. 978.20s - 983.20s | So we obviously very kindly help him to open the door. 984.90s - 989.66s | On the other side was an armed guard cat 989.66s - 993.10s | who saw us in complicity with the technician 993.10s - 995.74s | plus the uniforms and credentials. 996.70s - 1000.38s | He went from the angry cat gesture, you know, 1000.38s - 1005.38s | as a simple raised eyebrow of a cat who had just eaten. 1009.71s - 1012.19s | So we advanced through the corridors, 1012.19s - 1017.19s | very similar to those in Dead Star or Jurassic Park 1017.63s - 1022.63s | or Resident Evil with double doors and control accesses. 1023.87s - 1028.87s | So we knock at a crystal door and a cat on duty appeared. 1031.15s - 1034.39s | Here it's very important for you to understand 1034.39s - 1037.27s | what is going on in the minds 1037.27s - 1041.79s | and behavior of our consultants. 1042.39s - 1044.87s | The cover must be 100% focused 1044.87s - 1047.83s | on establishing a situation of comfort 1049.59s - 1051.47s | and trust with the cat. 1051.47s - 1054.83s | So it is essential to play the pretext, 1054.83s - 1059.31s | the game without any doubt, without any hesitation. 1059.31s - 1061.79s | The alpha team members had to be perceived 1061.79s - 1065.65s | as a cat, as his companions. 1065.65s - 1069.67s | When in reality, they were counting the numbers of people, 1069.67s - 1073.91s | a lock, unattended equipment, available network points, 1073.91s - 1077.79s | access cameras, and printed information. 1077.79s - 1080.51s | So let's talk about the truth 1081.43s - 1084.89s | or the truth before the


chunk_text:
very similar to those in Dead Star or Jurassic Park 1017.63s - 1022.63s | or Resident Evil with double doors and control accesses. 1023.87s - 1028.87s | So we knock at a crystal door and a cat on duty appeared. 1031.15s - 1034.39s | Here it's very important for you to understand 1034.39s - 1037.27s | what is going on in the minds 1037.27s - 1041.79s | and behavior of our consultants. 1042.39s - 1044.87s | The cover must be 100% focused 1044.87s - 1047.83s | on establishing a situation of comfort 1049.59s - 1051.47s | and trust with the cat. 1051.47s - 1054.83s | So it is essential to play the pretext, 1054.83s - 1059.31s | the game without any doubt, without any hesitation. 1059.31s - 1061.79s | The alpha team members had to be perceived 1061.79s - 1065.65s | as a cat, as his companions. 1065.65s - 1069.67s | When in reality, they were counting the numbers of people, 1069.67s - 1073.91s | a lock, unattended equipment, available network points, 1073.91s - 1077.79s | access cameras, and printed information. 1077.79s - 1080.51s | So let's talk about the truth 1081.43s - 1084.89s | or the truth before the truth, you know? 1084.89s - 1087.33s | We are workers, that is the truth, 1087.33s - 1091.73s | but the truth before the truth is our real objective. 1091.73s - 1095.85s | So the cat can't know that, can't know that, yeah. 1095.85s - 1100.19s | So I need two volunteers. 1101.17s - 1107.96s | So I think there's one here. 1107.96s - 1110.66s | You say, and the guy there. 1112.48s - 1113.32s | I don't know. 1113.32s - 1115.78s | Yeah, yeah, you can come, come, come, and you too. 1115.78s - 1117.28s | Yeah, yeah, both. 1117.28s - 1118.12s | Yeah, yeah. 1119.28s - 1124.28s | So we will play an improv situation. 1125.10s - 1127.68s | So your name? 1127.68s - 1128.52s | Katya. 1128.52s - 1129.34s | Katya. 1130.02s - 1130.86s | You? 1130.86s - 1131.68s | Chris. 1131.68s - 1132.52s | Chris. 1132.52s - 1133.36s | Chris. 1133.36s - 1134.18s | Thank you both. 1134.18s - 1135.58s | So we're gonna make this improv 1135.58s - 1138.62s | to know the truth before the truth. 1138.62s - 1143.54s | So I'm gonna give you this. 1143.54s - 1144.38s | Let me check. 1145.22s -


chunk_text:
truth, you know? 1084.89s - 1087.33s | We are workers, that is the truth, 1087.33s - 1091.73s | but the truth before the truth is our real objective. 1091.73s - 1095.85s | So the cat can't know that, can't know that, yeah. 1095.85s - 1100.19s | So I need two volunteers. 1101.17s - 1107.96s | So I think there's one here. 1107.96s - 1110.66s | You say, and the guy there. 1112.48s - 1113.32s | I don't know. 1113.32s - 1115.78s | Yeah, yeah, you can come, come, come, and you too. 1115.78s - 1117.28s | Yeah, yeah, both. 1117.28s - 1118.12s | Yeah, yeah. 1119.28s - 1124.28s | So we will play an improv situation. 1125.10s - 1127.68s | So your name? 1127.68s - 1128.52s | Katya. 1128.52s - 1129.34s | Katya. 1130.02s - 1130.86s | You? 1130.86s - 1131.68s | Chris. 1131.68s - 1132.52s | Chris. 1132.52s - 1133.36s | Chris. 1133.36s - 1134.18s | Thank you both. 1134.18s - 1135.58s | So we're gonna make this improv 1135.58s - 1138.62s | to know the truth before the truth. 1138.62s - 1143.54s | So I'm gonna give you this. 1143.54s - 1144.38s | Let me check. 1145.22s - 1154.42s | It's a noise canceling headphones. 1154.42s - 1155.32s | Sorry. 1155.32s - 1156.16s | Put it on. 1156.16s - 1162.70s | Yeah. 1162.70s - 1165.06s | Okay, so you can, 1166.64s - 1168.24s | Chris, Chris, Chris, Chris. 1168.24s - 1171.84s | So the truth will be, 1171.84s - 1174.50s | you're gonna painting a fence. 1174.50s - 1177.24s | That is the truth, the reality, the action. 1177.24s - 1179.86s | But the real goal is gonna be, 1180.94s - 1185.94s | she needs to touch her left eye, like here. 1187.34s - 1190.56s | But the truth is painting a fence. 1195.18s - 1196.10s | Paint, no? 1196.10s - 1196.94s | Yeah, yeah. 1196.94s - 1197.76s | Let me check. 1197.76s - 1198.60s | Yeah, it's everything. 1198.60s - 1199.66s | Okay, let's start. 1200.70s - 1202.30s | Sorry, sorry, sorry, sorry. 1202.30s - 1208.64s | Yeah. 1208.66s - 1210.16s | Rub, Chilean rub. 1211.22s - 1213.90s | So let's start the improv. 1213.90s - 1217.92s | So action. 1217.92s - 1219.52s | He's painting something. 1220.52s - 1225.47s | You can help. 1225.47s - 1228.63s | Watch out with the paint. 1228.63s - 1232.00s |


chunk_text:
1154.42s | It's a noise canceling headphones. 1154.42s - 1155.32s | Sorry. 1155.32s - 1156.16s | Put it on. 1156.16s - 1162.70s | Yeah. 1162.70s - 1165.06s | Okay, so you can, 1166.64s - 1168.24s | Chris, Chris, Chris, Chris. 1168.24s - 1171.84s | So the truth will be, 1171.84s - 1174.50s | you're gonna painting a fence. 1174.50s - 1177.24s | That is the truth, the reality, the action. 1177.24s - 1179.86s | But the real goal is gonna be, 1180.94s - 1185.94s | she needs to touch her left eye, like here. 1187.34s - 1190.56s | But the truth is painting a fence. 1195.18s - 1196.10s | Paint, no? 1196.10s - 1196.94s | Yeah, yeah. 1196.94s - 1197.76s | Let me check. 1197.76s - 1198.60s | Yeah, it's everything. 1198.60s - 1199.66s | Okay, let's start. 1200.70s - 1202.30s | Sorry, sorry, sorry, sorry. 1202.30s - 1208.64s | Yeah. 1208.66s - 1210.16s | Rub, Chilean rub. 1211.22s - 1213.90s | So let's start the improv. 1213.90s - 1217.92s | So action. 1217.92s - 1219.52s | He's painting something. 1220.52s - 1225.47s | You can help. 1225.47s - 1228.63s | Watch out with the paint. 1228.63s - 1232.00s | That was fast. 1232.00s - 1237.84s | Look for your goal. 1237.84s - 1240.98s | Okay, give them an applause, please. 1241.96s - 1243.04s | Thank you. 1243.04s - 1248.20s | But who was the real rat? 1248.20s - 1249.76s | Wait, wait, wait. 1249.78s - 1251.94s | Who was the real rat? 1251.94s - 1257.37s | Let's hear this. 1257.37s - 1259.21s | It's a secret instruction. 1259.21s - 1261.49s | Thank you for being my real helper. 1261.49s - 1264.49s | The first thing I need you to do is to move your head 1264.49s - 1266.81s | as if you were listening to music. 1266.81s - 1267.97s | Now, look at me. 1269.69s - 1272.13s | She had the real goal. 1272.13s - 1275.29s | The real goal was he touched his nose. 1276.57s - 1281.57s | But everyone saw, see, the truth is painting, you know? 1281.59s - 1283.83s | This game is yours. 1283.83s - 1286.47s | You have to get the other participant 1286.47s - 1290.07s | to touch his or her own nose. 1290.07s - 1291.29s | Break a leg. 1291.29s - 1294.31s | Now, I leave you with a classic from my


chunk_text:
That was fast. 1232.00s - 1237.84s | Look for your goal. 1237.84s - 1240.98s | Okay, give them an applause, please. 1241.96s - 1243.04s | Thank you. 1243.04s - 1248.20s | But who was the real rat? 1248.20s - 1249.76s | Wait, wait, wait. 1249.78s - 1251.94s | Who was the real rat? 1251.94s - 1257.37s | Let's hear this. 1257.37s - 1259.21s | It's a secret instruction. 1259.21s - 1261.49s | Thank you for being my real helper. 1261.49s - 1264.49s | The first thing I need you to do is to move your head 1264.49s - 1266.81s | as if you were listening to music. 1266.81s - 1267.97s | Now, look at me. 1269.69s - 1272.13s | She had the real goal. 1272.13s - 1275.29s | The real goal was he touched his nose. 1276.57s - 1281.57s | But everyone saw, see, the truth is painting, you know? 1281.59s - 1283.83s | This game is yours. 1283.83s - 1286.47s | You have to get the other participant 1286.47s - 1290.07s | to touch his or her own nose. 1290.07s - 1291.29s | Break a leg. 1291.29s - 1294.31s | Now, I leave you with a classic from my country, 1294.31s - 1296.63s | the true game of Tiro de Gracia. 1297.99s - 1300.11s | Yeah, now give them applause. 1302.56s - 1303.64s | Nice, nice. 1303.64s - 1306.36s | Okay, now you understand the truth 1306.36s - 1308.84s | or the truth before the truth. 1308.84s - 1309.68s | Two minutes. 1310.52s - 1311.96s | No. 1311.98s - 1313.94s | Okay, this is gonna be fast. 1316.66s - 1321.58s | Okay, coverage consultant introduced himself 1321.58s - 1323.76s | and told the proposal of the visit 1323.76s - 1328.54s | that the cat on duty, very doubtful and skeptical. 1328.54s - 1329.48s | Let's see them. 1330.78s - 1332.34s | I gotta be fast. 1332.34s - 1334.50s | So, what happens here? 1334.50s - 1336.18s | We introduce himself. 1336.18s - 1339.98s | We send the email from the account. 1339.98s - 1345.23s | And after that, we have the permission. 1345.23s - 1348.17s | So, we talk with everyone in there. 1348.17s - 1352.67s | We give them the sticker. 1352.67s - 1354.15s | We send this email. 1354.15s - 1357.71s | And in this email says that the entire department 1357.71s - 1359.31s | is gonna


chunk_text:
country, 1294.31s - 1296.63s | the true game of Tiro de Gracia. 1297.99s - 1300.11s | Yeah, now give them applause. 1302.56s - 1303.64s | Nice, nice. 1303.64s - 1306.36s | Okay, now you understand the truth 1306.36s - 1308.84s | or the truth before the truth. 1308.84s - 1309.68s | Two minutes. 1310.52s - 1311.96s | No. 1311.98s - 1313.94s | Okay, this is gonna be fast. 1316.66s - 1321.58s | Okay, coverage consultant introduced himself 1321.58s - 1323.76s | and told the proposal of the visit 1323.76s - 1328.54s | that the cat on duty, very doubtful and skeptical. 1328.54s - 1329.48s | Let's see them. 1330.78s - 1332.34s | I gotta be fast. 1332.34s - 1334.50s | So, what happens here? 1334.50s - 1336.18s | We introduce himself. 1336.18s - 1339.98s | We send the email from the account. 1339.98s - 1345.23s | And after that, we have the permission. 1345.23s - 1348.17s | So, we talk with everyone in there. 1348.17s - 1352.67s | We give them the sticker. 1352.67s - 1354.15s | We send this email. 1354.15s - 1357.71s | And in this email says that the entire department 1357.71s - 1359.31s | is gonna be on field. 1359.31s - 1361.55s | So, if you want to talk with them, 1361.55s - 1365.63s | you need to call to our phone, yeah? 1365.63s - 1368.35s | So, stickers. 1369.29s - 1374.17s | So, we start to walking in other places, other offices. 1374.17s - 1377.37s | And you know the flow, you know? 1377.37s - 1379.81s | The call, the email. 1379.81s - 1383.53s | And we arrive to an estranged office. 1383.53s - 1386.13s | Inside of this office was a few people, 1386.13s - 1388.73s | but many unlock equipment. 1388.73s - 1391.29s | One of them says, we don't block them 1391.29s - 1393.21s | to be able to monitor. 1393.21s - 1398.21s | To this day, I do not know how we contain our excitement. 1398.21s - 1400.83s | It was the data center cameras. 1400.83s - 1405.83s | And as an old man who just know only fans, I asked, 1405.87s - 1407.07s | what is that? 1407.07s - 1408.79s | What is that place? 1408.79s - 1410.67s | And he says, it's the data center. 1410.67s - 1414.83s | Oh, and it's in here? 1414.83s - 1418.47s | Yes,


chunk_text:
be on field. 1359.31s - 1361.55s | So, if you want to talk with them, 1361.55s - 1365.63s | you need to call to our phone, yeah? 1365.63s - 1368.35s | So, stickers. 1369.29s - 1374.17s | So, we start to walking in other places, other offices. 1374.17s - 1377.37s | And you know the flow, you know? 1377.37s - 1379.81s | The call, the email. 1379.81s - 1383.53s | And we arrive to an estranged office. 1383.53s - 1386.13s | Inside of this office was a few people, 1386.13s - 1388.73s | but many unlock equipment. 1388.73s - 1391.29s | One of them says, we don't block them 1391.29s - 1393.21s | to be able to monitor. 1393.21s - 1398.21s | To this day, I do not know how we contain our excitement. 1398.21s - 1400.83s | It was the data center cameras. 1400.83s - 1405.83s | And as an old man who just know only fans, I asked, 1405.87s - 1407.07s | what is that? 1407.07s - 1408.79s | What is that place? 1408.79s - 1410.67s | And he says, it's the data center. 1410.67s - 1414.83s | Oh, and it's in here? 1414.83s - 1418.47s | Yes, but only we and the technicians can enter. 1418.47s - 1420.77s | Then, the cover rat seriously said, 1422.51s - 1424.99s | okay, I'm gonna finish here. 1424.99s - 1429.65s | So, after that, we went to the data center. 1429.65s - 1432.57s | Now, you're gonna lost a rap song with this. 1432.57s - 1437.57s | I'm gonna, we have this rap song, how we get in there. 1439.51s - 1442.81s | Sorry, technical problems. 1443.83s - 1446.85s | But we go in there, we go to the data center, 1446.85s - 1450.73s | we give the guy another sticker, 1450.73s - 1454.39s | and then we go to the rat hole. 1455.37s - 1459.53s | So, sorry, you can't see everything, but nah, it's okay. 1459.53s - 1460.63s | Hope you enjoy it.


chunk_text:
but only we and the technicians can enter. 1418.47s - 1420.77s | Then, the cover rat seriously said, 1422.51s - 1424.99s | okay, I'm gonna finish here. 1424.99s - 1429.65s | So, after that, we went to the data center. 1429.65s - 1432.57s | Now, you're gonna lost a rap song with this. 1432.57s - 1437.57s | I'm gonna, we have this rap song, how we get in there. 1439.51s - 1442.81s | Sorry, technical problems. 1443.83s - 1446.85s | But we go in there, we go to the data center, 1446.85s - 1450.73s | we give the guy another sticker, 1450.73s - 1454.39s | and then we go to the rat hole. 1455.37s - 1459.53s | So, sorry, you can't see everything, but nah, it's okay. 1459.53s - 1460.63s | Hope you enjoy it.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=w4M_Z0D1rdY", "title": "DEF CON 32 - GUR RIBYHGVBA BS PELCGBTENCUL - Jeff Man", "description": "I recently googled the meaning of \u201cencryption\u201d and found this definition on Wikipedia: \u201cIn cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext.\u201d Um\u2026no, encoding produces code, enciphering produces ciphertext, encryption is more than just encoding, and so on. Given the jumbling together of historically very unique and significant terminology I set out to find the actual, historical definitions and try to find a way to teach and/or demonstrate the differences in the foundational forms of cryptography. But I quickly noticed that some of this terminology is so often mis-applied in our digital age that I wondered if maybe there has been an evolution of the meanings of these terms? I might not like it, but I\u2019m open to that possibility. This very quickly led me to the conclusion that my research on this topic would make for an interesting talk and so here we are. I want to share the classical, historical forms of cryptography, discuss the etymology of the terminology, look at how the words apply today \u2013 and help the audience decide if the actual meanings even matter (or it\u2019s just me). One important consideration is the tradeoff between keeping the data secret (security) and protecting the identity of individuals associated with the data (privacy). I hope you\u2019ll join me in this journey to victory (or defeat) in the ongoing battle of preserving the classic goals and objectives of data security.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1422, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.65s | This text was transcribed using whisper model: large-v2 First of all, what's the name of this talk? 6.65s - 7.73s | Anyone? 7.73s - 8.93s | You have to shout. 18.31s - 21.38s | How about that? 21.38s - 25.10s | And an example of something called a Caesar cipher, 25.10s - 27.34s | a simple substitution cipher. 27.34s - 29.62s | In our tech industry, 29.62s - 33.98s | we sometimes call it rot, rotation cipher. 35.38s - 36.50s | My name is Jeff Mann. 36.58s - 41.02s | I am a former NSA cryptologist, 41.02s - 45.06s | consultant advisor, industry old timer. 45.06s - 47.50s | And feel free to reach out to me


chunk_text:
words apply today \u2013 and help the audience decide if the actual meanings even matter (or it\u2019s just me). One important consideration is the tradeoff between keeping the data secret (security) and protecting the identity of individuals associated with the data (privacy). I hope you\u2019ll join me in this journey to victory (or defeat) in the ongoing battle of preserving the classic goals and objectives of data security.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 1422, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 6.65s | This text was transcribed using whisper model: large-v2 First of all, what's the name of this talk? 6.65s - 7.73s | Anyone? 7.73s - 8.93s | You have to shout. 18.31s - 21.38s | How about that? 21.38s - 25.10s | And an example of something called a Caesar cipher, 25.10s - 27.34s | a simple substitution cipher. 27.34s - 29.62s | In our tech industry, 29.62s - 33.98s | we sometimes call it rot, rotation cipher. 35.38s - 36.50s | My name is Jeff Mann. 36.58s - 41.02s | I am a former NSA cryptologist, 41.02s - 45.06s | consultant advisor, industry old timer. 45.06s - 47.50s | And feel free to reach out to me anytime 47.50s - 49.26s | for questions, mentoring. 51.42s - 53.30s | Take pictures, send them to me. 55.54s - 58.14s | Spent the early part of my career, as I said, at NSA. 58.14s - 60.40s | I've been out for almost 30 years now. 62.06s - 65.02s | 20 years ago, I got into doing something called PCI. 66.50s - 69.28s | Has PCI ever been said from stage at DEF CON before? 69.28s - 70.12s | I don't know. 74.81s - 76.51s | Most people in this industry know me 76.51s - 79.15s | because I was one of the architects, 79.15s - 81.23s | one of the founders of what came to be known 81.23s - 83.39s | as the first NSA red team. 83.39s - 86.59s | So I was doing pen testing back in the early 90s 86.59s - 90.31s | and did it up until about the mid 90s for NSA. 90.31s - 93.53s | But I was also a cryptanalyst at NSA, 93.53s - 95.23s | which is why I'm here talking, 95.23s - 98.03s | representing the crypto and privacy village, by the way. 100.35s - 104.79s | I was working


chunk_text:
anytime 47.50s - 49.26s | for questions, mentoring. 51.42s - 53.30s | Take pictures, send them to me. 55.54s - 58.14s | Spent the early part of my career, as I said, at NSA. 58.14s - 60.40s | I've been out for almost 30 years now. 62.06s - 65.02s | 20 years ago, I got into doing something called PCI. 66.50s - 69.28s | Has PCI ever been said from stage at DEF CON before? 69.28s - 70.12s | I don't know. 74.81s - 76.51s | Most people in this industry know me 76.51s - 79.15s | because I was one of the architects, 79.15s - 81.23s | one of the founders of what came to be known 81.23s - 83.39s | as the first NSA red team. 83.39s - 86.59s | So I was doing pen testing back in the early 90s 86.59s - 90.31s | and did it up until about the mid 90s for NSA. 90.31s - 93.53s | But I was also a cryptanalyst at NSA, 93.53s - 95.23s | which is why I'm here talking, 95.23s - 98.03s | representing the crypto and privacy village, by the way. 100.35s - 104.79s | I was working as a cryptologist designing systems 104.79s - 106.39s | back in the late 80s. 106.39s - 107.39s | One of the things I did, 107.39s - 110.83s | because computers were becoming a thing, 110.83s - 113.71s | the digital age was becoming a thing. 113.71s - 116.51s | I had a client that asked if they could do 116.51s - 120.27s | a paper manual process on a PC 120.27s - 121.87s | and was able to produce what I think 121.87s - 125.15s | was the first software-based NSA produced, 125.15s - 126.87s | which only did half of it. 126.87s - 130.19s | The spy in the field was still using the paper, 130.19s - 133.39s | but the case handler was using a PC 133.39s - 137.61s | and got the one-time pad key put on floppy disk. 138.91s - 141.31s | I also had another customer, US Special Forces, 141.31s - 143.43s | that I designed a cipher wheel for 143.43s - 146.19s | that would help them with their encryption and decryption 146.19s - 151.56s | in the field of one-time pads. 151.56s - 155.88s | But this is just a little bit of


chunk_text:
as a cryptologist designing systems 104.79s - 106.39s | back in the late 80s. 106.39s - 107.39s | One of the things I did, 107.39s - 110.83s | because computers were becoming a thing, 110.83s - 113.71s | the digital age was becoming a thing. 113.71s - 116.51s | I had a client that asked if they could do 116.51s - 120.27s | a paper manual process on a PC 120.27s - 121.87s | and was able to produce what I think 121.87s - 125.15s | was the first software-based NSA produced, 125.15s - 126.87s | which only did half of it. 126.87s - 130.19s | The spy in the field was still using the paper, 130.19s - 133.39s | but the case handler was using a PC 133.39s - 137.61s | and got the one-time pad key put on floppy disk. 138.91s - 141.31s | I also had another customer, US Special Forces, 141.31s - 143.43s | that I designed a cipher wheel for 143.43s - 146.19s | that would help them with their encryption and decryption 146.19s - 151.56s | in the field of one-time pads. 151.56s - 155.88s | But this is just a little bit of cryptographic history 155.88s - 158.64s | to explain where we came from in cryptography. 158.64s - 161.44s | You were just hearing a talk talking about encryption 161.44s - 163.24s | that works in the digital age. 164.60s - 167.56s | But basically, people have been trying to keep secrets 167.56s - 169.44s | for thousands of years. 169.44s - 172.64s | And in the early days, it was primarily keeping secrets 172.64s - 176.56s | and communicating messages from one end to another, 176.56s - 179.00s | very often used by the military, 179.00s - 181.24s | trying to get commands and directions 181.24s - 184.20s | to troops on the battlefield from the command headquarters 184.20s - 186.40s | and the generals and things like that. 187.36s - 190.44s | There's basically, historically, 190.44s - 192.08s | two different ways of doing that, 192.08s - 194.76s | two different ways of protecting messages, 194.76s - 196.68s | and that's called codes and ciphers. 198.28s - 201.36s | The difference between the two, very briefly, 201.36s - 203.92s | the way I learned it many years ago, 203.92s - 208.92s | is code is something you do to words


chunk_text:
cryptographic history 155.88s - 158.64s | to explain where we came from in cryptography. 158.64s - 161.44s | You were just hearing a talk talking about encryption 161.44s - 163.24s | that works in the digital age. 164.60s - 167.56s | But basically, people have been trying to keep secrets 167.56s - 169.44s | for thousands of years. 169.44s - 172.64s | And in the early days, it was primarily keeping secrets 172.64s - 176.56s | and communicating messages from one end to another, 176.56s - 179.00s | very often used by the military, 179.00s - 181.24s | trying to get commands and directions 181.24s - 184.20s | to troops on the battlefield from the command headquarters 184.20s - 186.40s | and the generals and things like that. 187.36s - 190.44s | There's basically, historically, 190.44s - 192.08s | two different ways of doing that, 192.08s - 194.76s | two different ways of protecting messages, 194.76s - 196.68s | and that's called codes and ciphers. 198.28s - 201.36s | The difference between the two, very briefly, 201.36s - 203.92s | the way I learned it many years ago, 203.92s - 208.92s | is code is something you do to words and phrases 209.68s - 212.56s | or thoughts and ideas to try to shrink it down 212.56s - 215.40s | to something that's briefer to transmit 215.76s - 218.72s | and to communicate, whereas a cipher 218.72s - 220.88s | is something you're doing to scramble 220.88s - 224.48s | and create what used to be called a cryptogram, 224.48s - 226.60s | but it's a one character, one letter, 226.60s - 229.64s | one number relationship. 230.56s - 232.36s | There's two ways of doing that. 232.36s - 237.36s | One way is to do the title of this talk, a substitution. 237.52s - 240.52s | You're replacing the real letters, the real characters 240.52s - 243.08s | for something obscure and different 243.08s - 245.00s | in hopes of confusing people, 245.60s - 248.08s | which seemed to work since a lot and a lot of people, 248.08s - 249.32s | not a lot of people seem to know 249.32s - 250.80s | what the name of the talk was. 251.68s - 254.40s | The other thing you can do is you simply 255.72s - 260.72s | scramble the letters, same letters, 260.76s - 262.88s | just put


chunk_text:
and phrases 209.68s - 212.56s | or thoughts and ideas to try to shrink it down 212.56s - 215.40s | to something that's briefer to transmit 215.76s - 218.72s | and to communicate, whereas a cipher 218.72s - 220.88s | is something you're doing to scramble 220.88s - 224.48s | and create what used to be called a cryptogram, 224.48s - 226.60s | but it's a one character, one letter, 226.60s - 229.64s | one number relationship. 230.56s - 232.36s | There's two ways of doing that. 232.36s - 237.36s | One way is to do the title of this talk, a substitution. 237.52s - 240.52s | You're replacing the real letters, the real characters 240.52s - 243.08s | for something obscure and different 243.08s - 245.00s | in hopes of confusing people, 245.60s - 248.08s | which seemed to work since a lot and a lot of people, 248.08s - 249.32s | not a lot of people seem to know 249.32s - 250.80s | what the name of the talk was. 251.68s - 254.40s | The other thing you can do is you simply 255.72s - 260.72s | scramble the letters, same letters, 260.76s - 262.88s | just put them in a different order in some way 262.88s - 265.40s | where the intended recipient knows 265.40s - 267.60s | how to put it back together. 267.60s - 269.72s | I can give you a real brief example. 271.08s - 274.48s | This is an example of a transposition. 275.16s - 276.76s | Anybody know what my shirt says? 280.38s - 284.58s | Close, too many secrets, too many secrets. 284.58s - 285.42s | Very good. 288.28s - 293.28s | In terms of US history, back in the American Revolution, 294.08s - 296.24s | there was codes and ciphers used 296.24s - 301.24s | and an example of a code would be one if by land, 301.36s - 305.80s | two if by sea, big long phrases reduced down 305.80s - 310.28s | to just a light or two lights in a church bell tower. 311.84s - 316.24s | There was also codes being used by the armies. 316.24s - 318.32s | They had entire code books written up 318.32s - 321.56s | where numbers would represent all sorts of words 321.56s - 326.56s | and just as an example, there was Agent 711, 326.72s - 330.00s | which


chunk_text:
them in a different order in some way 262.88s - 265.40s | where the intended recipient knows 265.40s - 267.60s | how to put it back together. 267.60s - 269.72s | I can give you a real brief example. 271.08s - 274.48s | This is an example of a transposition. 275.16s - 276.76s | Anybody know what my shirt says? 280.38s - 284.58s | Close, too many secrets, too many secrets. 284.58s - 285.42s | Very good. 288.28s - 293.28s | In terms of US history, back in the American Revolution, 294.08s - 296.24s | there was codes and ciphers used 296.24s - 301.24s | and an example of a code would be one if by land, 301.36s - 305.80s | two if by sea, big long phrases reduced down 305.80s - 310.28s | to just a light or two lights in a church bell tower. 311.84s - 316.24s | There was also codes being used by the armies. 316.24s - 318.32s | They had entire code books written up 318.32s - 321.56s | where numbers would represent all sorts of words 321.56s - 326.56s | and just as an example, there was Agent 711, 326.72s - 330.00s | which was actually the code for George Washington, 330.00s - 334.90s | General of the Army. 334.90s - 336.54s | They also were using ciphers, 336.54s - 338.98s | but in this particular instance, 338.98s - 342.34s | they weren't using letters to replace letters. 342.34s - 346.26s | They were using symbols, but it was still a Caesar cipher. 346.26s - 349.22s | It was still a simple substitution system 349.22s - 351.54s | and of course, Caesar cipher, that was actually used 351.54s - 353.82s | by the Confederate Army in the Civil War. 353.82s - 357.18s | They had a cipher wheel themselves, 357.18s - 358.62s | which was part of the inspiration 358.62s - 362.26s | for the cipher wheel that I designed many years later. 362.86s - 367.86s | Freemasons, they have loved to use ciphers for many years. 369.46s - 371.58s | The particular cipher they use, 371.58s - 374.14s | these are examples of tombstones 374.14s - 376.62s | of dead members of the Freemasons 376.62s - 378.62s | and they often would leave messages, 378.62s - 382.26s | encrypted messages on their tombstones 382.26s - 384.62s | using something called a pigpen cipher,


chunk_text:
was actually the code for George Washington, 330.00s - 334.90s | General of the Army. 334.90s - 336.54s | They also were using ciphers, 336.54s - 338.98s | but in this particular instance, 338.98s - 342.34s | they weren't using letters to replace letters. 342.34s - 346.26s | They were using symbols, but it was still a Caesar cipher. 346.26s - 349.22s | It was still a simple substitution system 349.22s - 351.54s | and of course, Caesar cipher, that was actually used 351.54s - 353.82s | by the Confederate Army in the Civil War. 353.82s - 357.18s | They had a cipher wheel themselves, 357.18s - 358.62s | which was part of the inspiration 358.62s - 362.26s | for the cipher wheel that I designed many years later. 362.86s - 367.86s | Freemasons, they have loved to use ciphers for many years. 369.46s - 371.58s | The particular cipher they use, 371.58s - 374.14s | these are examples of tombstones 374.14s - 376.62s | of dead members of the Freemasons 376.62s - 378.62s | and they often would leave messages, 378.62s - 382.26s | encrypted messages on their tombstones 382.26s - 384.62s | using something called a pigpen cipher, 384.62s - 387.22s | where instead of letters, they would write letters 387.22s - 389.86s | into like tic-tac-toe squares 389.86s - 391.78s | and instead of the letters, 391.82s - 394.50s | they would simply use the shape of the box 394.50s - 396.58s | or the cell that the letter fell in. 396.58s - 401.46s | This is kind of what it looks like. 401.46s - 403.78s | If you've ever seen the movie National Treasure, 403.78s - 406.74s | they have something that they call the Ottendorf cipher, 406.74s - 408.58s | where there's a whole bunch of numbers 408.58s - 411.18s | written on the back of the Declaration of Independence 411.18s - 415.02s | and invisible ink and that translates to, 415.02s - 418.98s | if you know the right book, the particular page of a book, 418.98s - 421.18s | the particular line on the page 421.18s - 424.02s | and the particular letter across the line. 425.42s - 427.02s | That really kind of existed. 427.02s - 430.70s | That is something that was done in the revolution. 430.70s - 432.30s | It was called the Arnold cipher. 434.82s - 437.90s | Others,


chunk_text:
384.62s - 387.22s | where instead of letters, they would write letters 387.22s - 389.86s | into like tic-tac-toe squares 389.86s - 391.78s | and instead of the letters, 391.82s - 394.50s | they would simply use the shape of the box 394.50s - 396.58s | or the cell that the letter fell in. 396.58s - 401.46s | This is kind of what it looks like. 401.46s - 403.78s | If you've ever seen the movie National Treasure, 403.78s - 406.74s | they have something that they call the Ottendorf cipher, 406.74s - 408.58s | where there's a whole bunch of numbers 408.58s - 411.18s | written on the back of the Declaration of Independence 411.18s - 415.02s | and invisible ink and that translates to, 415.02s - 418.98s | if you know the right book, the particular page of a book, 418.98s - 421.18s | the particular line on the page 421.18s - 424.02s | and the particular letter across the line. 425.42s - 427.02s | That really kind of existed. 427.02s - 430.70s | That is something that was done in the revolution. 430.70s - 432.30s | It was called the Arnold cipher. 434.82s - 437.90s | Others, examples of transpositions 437.90s - 441.86s | and this goes back, I think it's to the ancient Egyptians. 441.86s - 444.82s | They used to have a stick of a certain size 444.82s - 447.06s | and wrap a leather strap around it, 447.06s - 450.42s | write their message and then unwind it 450.42s - 452.82s | and so it was just a bunch of random letters 452.86s - 455.02s | written out on this big long strip. 455.02s - 456.70s | They would send it to the recipient. 456.70s - 459.10s | He would have to have the same size stick 459.10s - 462.74s | to wrap it back together again and put it back in order. 462.74s - 465.18s | Also something that was used that I learned about 465.18s - 466.70s | in my early days was something 466.70s - 468.66s | that's sort of like a crossword puzzle, 468.66s - 470.82s | but you have a sort of a stencil, 470.82s - 473.14s | a square with certain holes cut out of it. 473.14s - 476.38s | You'd write your message in one letter at a time, 476.38s - 478.58s | rotate it, keep going


