# MediaChunks

chunk_text:
care is, okay, well, we'll just make it not connected to the 1899.24s - 1906.52s | Ethernet, and that removes a lot of our risk. But as we start to see devices evolve and additional 1906.52s - 1912.92s | functionality being added, once you start doing that, you can start impacting some of the intended 1912.92s - 1918.12s | use of that medical device and some of the core functionality that that device is providing. 1918.12s - 1923.48s | So there's a greater cost to some of those mitigations that were available on older 1923.48s - 1929.32s | products may no longer be available on some of the more recent products that are going out. So 1929.32s - 1938.04s | it's a complex issue. It's also a regulated environment for updating and patching devices. 1938.04s - 1946.44s | So making sure that addressing some of those challenges to make sure that the device is not 1946.44s - 1954.60s | impacted by some of these updates to address some of the vulnerabilities, it's going to take 1954.60s - 1961.72s | a kind of large collaborative effort to make sure that all of the nuances, the challenges, 1961.72s - 1968.20s | and the best product for patients is what's ultimately achieved. Because at the end of the 1968.20s - 1973.40s | day, that's always been FDA's mission while I worked there. It's always putting the patient 1973.40s - 1981.08s | first and putting the patient's top of mind in all of our approaches. But the legacy device 1981.08s - 1987.80s | challenge is just one that's going to take a lot of government coordination as well as a lot of 1987.80s - 1992.84s | coordination across healthcare facilities and the medical device manufacturer community 1993.96s - 1999.64s | in order to get to workable solutions, not just for what's out there today, but also 2000.36s - 2006.20s | to maintain the devices that are currently out there and going to be going out there because 2006.76s - 2014.04s | the medical device lifecycle is so different than traditional tech. Clinicians will use a device 2014.04s - 2020.92s | until it no longer physically functions, and that's a hard place to secure. So it's just 2021.48s - 2027.48s | addressing all of those challenges and finding the right solutions and fixes. 2028.04s - 2031.00s | Fantastic. And I'm going to put you on


chunk_text:
the best product for patients is what's ultimately achieved. Because at the end of the 1968.20s - 1973.40s | day, that's always been FDA's mission while I worked there. It's always putting the patient 1973.40s - 1981.08s | first and putting the patient's top of mind in all of our approaches. But the legacy device 1981.08s - 1987.80s | challenge is just one that's going to take a lot of government coordination as well as a lot of 1987.80s - 1992.84s | coordination across healthcare facilities and the medical device manufacturer community 1993.96s - 1999.64s | in order to get to workable solutions, not just for what's out there today, but also 2000.36s - 2006.20s | to maintain the devices that are currently out there and going to be going out there because 2006.76s - 2014.04s | the medical device lifecycle is so different than traditional tech. Clinicians will use a device 2014.04s - 2020.92s | until it no longer physically functions, and that's a hard place to secure. So it's just 2021.48s - 2027.48s | addressing all of those challenges and finding the right solutions and fixes. 2028.04s - 2031.00s | Fantastic. And I'm going to put you on the spot. I didn't tell you about this question, 2031.00s - 2036.36s | so it's not. But I'm sure that healthcare is the only sector that you have to deal with that has 2036.36s - 2041.08s | this legacy problem, right? It's only healthcare. There are no lessons learned or stuff you've 2041.08s - 2046.52s | figured out from other sectors that we could apply here. Sarcasm. I mean, I'm assuming this 2046.52s - 2050.92s | is not a unique problem to healthcare. We talk about it a lot, but what are you seeing across 2050.92s - 2054.68s | other sectors that maybe we could learn a little bit from the healthcare side? 2054.68s - 2058.44s | I think it's not unique to the sector, which is probably a good thing and also a scary thing 2058.44s - 2065.56s | to some extent. What do we see across the board? I see a lot of Windows 95. I see a lot of Clippy 2065.56s - 2071.24s | from Office, who I'm a fan of Clippy. I want to bring Clippy back, but we really need to look at 2071.24s - 2074.68s | what the next generation looks like. We've seen


chunk_text:
the spot. I didn't tell you about this question, 2031.00s - 2036.36s | so it's not. But I'm sure that healthcare is the only sector that you have to deal with that has 2036.36s - 2041.08s | this legacy problem, right? It's only healthcare. There are no lessons learned or stuff you've 2041.08s - 2046.52s | figured out from other sectors that we could apply here. Sarcasm. I mean, I'm assuming this 2046.52s - 2050.92s | is not a unique problem to healthcare. We talk about it a lot, but what are you seeing across 2050.92s - 2054.68s | other sectors that maybe we could learn a little bit from the healthcare side? 2054.68s - 2058.44s | I think it's not unique to the sector, which is probably a good thing and also a scary thing 2058.44s - 2065.56s | to some extent. What do we see across the board? I see a lot of Windows 95. I see a lot of Clippy 2065.56s - 2071.24s | from Office, who I'm a fan of Clippy. I want to bring Clippy back, but we really need to look at 2071.24s - 2074.68s | what the next generation looks like. We've seen this in food and agriculture. We've seen this in 2074.68s - 2078.76s | the water sector. We've seen this in every sector as we go across the board. Because I think there's 2078.76s - 2084.28s | still a perception in most organizations that cybersecurity is a nuisance versus a good thing. 2084.28s - 2089.16s | Versus a necessity. We need to make that pivot and get people to realize that this isn't just 2089.16s - 2094.68s | about being an inconvenience or taking down a unit or part of your organization for a period of time 2094.68s - 2100.44s | so we can upgrade or patch, but it's a necessity to ensure the prompt and accurate and strong 2100.44s - 2104.84s | delivery of care and safe delivery of care. Well, frankly, also if people are looking at this 2104.84s - 2109.56s | really from a numbers perspective, it is in the best interest of an organization in the long run 2109.56s - 2114.76s | to take these steps early on. This is something we're seeing across the board, 2114.76s - 2119.00s | but it's frankly something that we need to change the entire landscape of how we're talking 2119.00s


chunk_text:
this in food and agriculture. We've seen this in 2074.68s - 2078.76s | the water sector. We've seen this in every sector as we go across the board. Because I think there's 2078.76s - 2084.28s | still a perception in most organizations that cybersecurity is a nuisance versus a good thing. 2084.28s - 2089.16s | Versus a necessity. We need to make that pivot and get people to realize that this isn't just 2089.16s - 2094.68s | about being an inconvenience or taking down a unit or part of your organization for a period of time 2094.68s - 2100.44s | so we can upgrade or patch, but it's a necessity to ensure the prompt and accurate and strong 2100.44s - 2104.84s | delivery of care and safe delivery of care. Well, frankly, also if people are looking at this 2104.84s - 2109.56s | really from a numbers perspective, it is in the best interest of an organization in the long run 2109.56s - 2114.76s | to take these steps early on. This is something we're seeing across the board, 2114.76s - 2119.00s | but it's frankly something that we need to change the entire landscape of how we're talking 2119.00s - 2123.96s | with everybody from CISOs to clinical personnel in the healthcare sector, but to CEOs and boards 2123.96s - 2128.68s | of directors to understand that we need to make this pivot from nuisance to necessity 2128.68s - 2132.76s | when it comes to patching, upgrading, and frankly cybersecurity at large. 2132.76s - 2137.72s | We've made some progress. I talk to a lot of healthcare CEOs these days that are talking 2137.72s - 2141.72s | to me about their attack surface, which frankly the fact that those two words are coming out of 2141.72s - 2146.12s | their mouth in that order is a wonderful thing. It means that they are acknowledging the fact 2146.12s - 2149.56s | that this is an issue. The fact that they know who their CISOs are and they're having these 2149.56s - 2154.28s | conversations is a huge step forward, but it's only the tip of the iceberg when you look at the 2154.28s - 2161.16s | breadth and scope of the healthcare sector of where we need to go. Awesome. All right, 2161.16s - 2165.40s | so who here feels a little ... I mean, I promise we started at


chunk_text:
- 2123.96s | with everybody from CISOs to clinical personnel in the healthcare sector, but to CEOs and boards 2123.96s - 2128.68s | of directors to understand that we need to make this pivot from nuisance to necessity 2128.68s - 2132.76s | when it comes to patching, upgrading, and frankly cybersecurity at large. 2132.76s - 2137.72s | We've made some progress. I talk to a lot of healthcare CEOs these days that are talking 2137.72s - 2141.72s | to me about their attack surface, which frankly the fact that those two words are coming out of 2141.72s - 2146.12s | their mouth in that order is a wonderful thing. It means that they are acknowledging the fact 2146.12s - 2149.56s | that this is an issue. The fact that they know who their CISOs are and they're having these 2149.56s - 2154.28s | conversations is a huge step forward, but it's only the tip of the iceberg when you look at the 2154.28s - 2161.16s | breadth and scope of the healthcare sector of where we need to go. Awesome. All right, 2161.16s - 2165.40s | so who here feels a little ... I mean, I promise we started at cake. Now we're talking about 2165.40s - 2170.44s | depressing stuff, but I'm trying to bounce it back up a little bit and say, how many of you 2170.44s - 2177.00s | out there would volunteer with the skills you have as a hacker to try to make this problem 2177.00s - 2181.16s | better? Raise your hand. Yeah, that's awesome. I hope to see almost all your hands in the future. 2181.16s - 2186.84s | Many of you are already, but let's talk about what you can do a little bit or maybe where 2187.96s - 2192.12s | I think in some sense we've seen some great growth in hackers involved in this, 2192.12s - 2197.48s | and maybe we can do a little bit more. So it's been over 15 years of great medical device 2197.48s - 2204.04s | cybersecurity research. Devices like pacemakers, insulin pumps, all sorts of stuff has been shown 2204.04s - 2209.32s | at places like this. Barnaby Jack, Jay Radcliffe, Billy Rios and others, these are names that we 2209.32s - 2215.88s | talk about at DEF CON and Black Hat, and they contributed to these tremendous leaps in what 2215.88s - 2219.72s


chunk_text:
cake. Now we're talking about 2165.40s - 2170.44s | depressing stuff, but I'm trying to bounce it back up a little bit and say, how many of you 2170.44s - 2177.00s | out there would volunteer with the skills you have as a hacker to try to make this problem 2177.00s - 2181.16s | better? Raise your hand. Yeah, that's awesome. I hope to see almost all your hands in the future. 2181.16s - 2186.84s | Many of you are already, but let's talk about what you can do a little bit or maybe where 2187.96s - 2192.12s | I think in some sense we've seen some great growth in hackers involved in this, 2192.12s - 2197.48s | and maybe we can do a little bit more. So it's been over 15 years of great medical device 2197.48s - 2204.04s | cybersecurity research. Devices like pacemakers, insulin pumps, all sorts of stuff has been shown 2204.04s - 2209.32s | at places like this. Barnaby Jack, Jay Radcliffe, Billy Rios and others, these are names that we 2209.32s - 2215.88s | talk about at DEF CON and Black Hat, and they contributed to these tremendous leaps in what 2215.88s - 2219.72s | happened at the FDA or what happened in the national conversation about medical device 2219.72s - 2224.92s | cybersecurity, and that came from folks like you. It came from hackers. You guys did something, 2224.92s - 2231.00s | you showed others, and it caused some amazing action to happen. But stuff's kind of changed a 2231.00s - 2236.68s | little bit. Anyone seen a really good medical device, uh, hack on, on a big stage at Black 2236.68s - 2243.48s | Hat or DEF CON recently? No. The question I have is we have great spaces like the Biohacking 2243.48s - 2246.36s | Village. If you haven't had a chance to check it out, you definitely should, where hackers 2246.36s - 2251.08s | get their hands on medical devices. But do we need to do more? Do we need to be giving more 2251.08s - 2256.92s | medical devices, more exposure to the folks in this room that have that power, and maybe do 2257.64s - 2264.76s | what Jay and Kevin Fu and others did 10 years ago to change things? So to the, to the audience, 2264.76s - 2269.88s | what should we do? How do we


chunk_text:
| happened at the FDA or what happened in the national conversation about medical device 2219.72s - 2224.92s | cybersecurity, and that came from folks like you. It came from hackers. You guys did something, 2224.92s - 2231.00s | you showed others, and it caused some amazing action to happen. But stuff's kind of changed a 2231.00s - 2236.68s | little bit. Anyone seen a really good medical device, uh, hack on, on a big stage at Black 2236.68s - 2243.48s | Hat or DEF CON recently? No. The question I have is we have great spaces like the Biohacking 2243.48s - 2246.36s | Village. If you haven't had a chance to check it out, you definitely should, where hackers 2246.36s - 2251.08s | get their hands on medical devices. But do we need to do more? Do we need to be giving more 2251.08s - 2256.92s | medical devices, more exposure to the folks in this room that have that power, and maybe do 2257.64s - 2264.76s | what Jay and Kevin Fu and others did 10 years ago to change things? So to the, to the audience, 2264.76s - 2269.88s | what should we do? How do we get these folks out here more engaged in medical devices or healthcare 2269.88s - 2277.08s | cybersecurity infrastructure or whistleblower? I mean, I think if, uh, if Apple could provide 2277.08s - 2280.84s | security researchers with devices, even if there is, you know, some rigmarole to get, to get access 2280.84s - 2285.72s | to them, um, the idea that you could get access to firmware for medical devices, the model that 2285.72s - 2289.80s | the Biohacking Village has started, um, feels like something that we can scale and we could scale 2289.80s - 2294.76s | and have a significant impact, um, and do it, doing it really in a very, once again, very collaborative 2294.76s - 2299.72s | way. Like there is so much good intent and so much capability in this community, um, and reward that 2300.28s - 2305.40s | success in that space. Uh, and just the, the dividends would be tremendous across the sector. 2305.40s - 2308.76s | Um, and I think the, the upfront investment actually wouldn't necessarily be significant 2308.76s - 2313.08s | if we choose to take that action, right? Like it's, it's fundamentally a choice that we need 2313.08s -


chunk_text:
get these folks out here more engaged in medical devices or healthcare 2269.88s - 2277.08s | cybersecurity infrastructure or whistleblower? I mean, I think if, uh, if Apple could provide 2277.08s - 2280.84s | security researchers with devices, even if there is, you know, some rigmarole to get, to get access 2280.84s - 2285.72s | to them, um, the idea that you could get access to firmware for medical devices, the model that 2285.72s - 2289.80s | the Biohacking Village has started, um, feels like something that we can scale and we could scale 2289.80s - 2294.76s | and have a significant impact, um, and do it, doing it really in a very, once again, very collaborative 2294.76s - 2299.72s | way. Like there is so much good intent and so much capability in this community, um, and reward that 2300.28s - 2305.40s | success in that space. Uh, and just the, the dividends would be tremendous across the sector. 2305.40s - 2308.76s | Um, and I think the, the upfront investment actually wouldn't necessarily be significant 2308.76s - 2313.08s | if we choose to take that action, right? Like it's, it's fundamentally a choice that we need 2313.08s - 2319.40s | to make first, um, across regulators, uh, manufacturers, uh, research agencies. But 2319.40s - 2322.84s | you know, if we make that choice, we commit a little bit and like, I think we will see 2322.84s - 2326.84s | massive returns very quickly. Um, so let's make that choice. 2328.84s - 2335.16s | So I'd say from the medical device perspective, there's a great benefit in that the new 2335.16s - 2341.08s | statutory requirements for connected medical devices includes that the manufacturer has to 2341.08s - 2347.96s | have a coordinated vulnerability disclosure process, um, so that it should become easier 2348.04s - 2355.00s | to access people at the company. If you're able to, um, identify potential vulnerabilities in a 2355.00s - 2363.00s | product, I will say one of the challenges and one of the, uh, things that the people that you named, 2363.00s - 2371.24s | um, had a immense amount of patience, um, especially for the older products that take 2371.24s - 2380.52s | longer to patch that had, uh, older devices, uh, devices that don't have as easy delivery 2380.52s - 2388.36s | mechanisms for patching and updates, um, in order to


chunk_text:
2319.40s | to make first, um, across regulators, uh, manufacturers, uh, research agencies. But 2319.40s - 2322.84s | you know, if we make that choice, we commit a little bit and like, I think we will see 2322.84s - 2326.84s | massive returns very quickly. Um, so let's make that choice. 2328.84s - 2335.16s | So I'd say from the medical device perspective, there's a great benefit in that the new 2335.16s - 2341.08s | statutory requirements for connected medical devices includes that the manufacturer has to 2341.08s - 2347.96s | have a coordinated vulnerability disclosure process, um, so that it should become easier 2348.04s - 2355.00s | to access people at the company. If you're able to, um, identify potential vulnerabilities in a 2355.00s - 2363.00s | product, I will say one of the challenges and one of the, uh, things that the people that you named, 2363.00s - 2371.24s | um, had a immense amount of patience, um, especially for the older products that take 2371.24s - 2380.52s | longer to patch that had, uh, older devices, uh, devices that don't have as easy delivery 2380.52s - 2388.36s | mechanisms for patching and updates, um, in order to ensure patient safety in that responsible 2388.36s - 2395.16s | disclosure of the vulnerabilities. Sometimes those take time, um, in order to process and develop, 2395.16s - 2399.48s | have the manufacturer develop patches to address the issues. 2399.48s - 2405.56s | Uh, but now that coordinated vulnerability disclosure is a requirement for new products, 2405.56s - 2410.76s | that should become a easier process, but definitely keep in mind that there is that 2410.76s - 2418.44s | patient safety aspect, um, that may take, cause the disclosure to take a little longer than you 2418.44s - 2425.32s | would like. Um, but you can still go through the process, still, um, engage with the manufacturer, 2425.32s - 2430.60s | still get the appropriate credit and while maintaining that patient safety consideration. 2431.88s - 2435.48s | Just a, just kind of a follow-up to that. I think talking to folks in the security research 2435.48s - 2439.96s | community, uh, especially if we're looking at like academic research, access to devices is the 2439.96s - 2444.28s | number one reason that we don't, I think, see more work in this space. Um, and there are a lot of 2444.28s -


chunk_text:
ensure patient safety in that responsible 2388.36s - 2395.16s | disclosure of the vulnerabilities. Sometimes those take time, um, in order to process and develop, 2395.16s - 2399.48s | have the manufacturer develop patches to address the issues. 2399.48s - 2405.56s | Uh, but now that coordinated vulnerability disclosure is a requirement for new products, 2405.56s - 2410.76s | that should become a easier process, but definitely keep in mind that there is that 2410.76s - 2418.44s | patient safety aspect, um, that may take, cause the disclosure to take a little longer than you 2418.44s - 2425.32s | would like. Um, but you can still go through the process, still, um, engage with the manufacturer, 2425.32s - 2430.60s | still get the appropriate credit and while maintaining that patient safety consideration. 2431.88s - 2435.48s | Just a, just kind of a follow-up to that. I think talking to folks in the security research 2435.48s - 2439.96s | community, uh, especially if we're looking at like academic research, access to devices is the 2439.96s - 2444.28s | number one reason that we don't, I think, see more work in this space. Um, and there are a lot of 2444.28s - 2450.20s | cons- they're clapping for you, but they're next door. Not everyone at DefCon is clapping 2450.20s - 2457.24s | for me while I'm talking. I appreciate the vibe though. Um, uh, like if you don't have access to 2457.24s - 2462.44s | any of the kind of artifacts of a device, it is very hard to assess its security properties. 2462.44s - 2468.36s | Um, and I think that's where we see, I mean, if, if, if, you know, controlling the, the ecosystem, 2468.36s - 2473.00s | um, may be disadvantageous in the long run or, or, or limiting access, like, like the 2474.12s - 2479.16s | providing more avenues for controlled access or, or just identifying what level of control 2479.16s - 2483.72s | is actually necessary to maintain whatever interest you have in devices safety in your 2483.72s - 2489.80s | own business, whatever. Um, I think reassessing kind of those, those parameters, uh, and then 2489.80s - 2495.32s | engaging more with the community, uh, like, like grad students can do a whole lot of really good 2495.32s - 2500.36s | work for, you know, not a whole lot of money. Like thank, thank the


chunk_text:
2450.20s | cons- they're clapping for you, but they're next door. Not everyone at DefCon is clapping 2450.20s - 2457.24s | for me while I'm talking. I appreciate the vibe though. Um, uh, like if you don't have access to 2457.24s - 2462.44s | any of the kind of artifacts of a device, it is very hard to assess its security properties. 2462.44s - 2468.36s | Um, and I think that's where we see, I mean, if, if, if, you know, controlling the, the ecosystem, 2468.36s - 2473.00s | um, may be disadvantageous in the long run or, or, or limiting access, like, like the 2474.12s - 2479.16s | providing more avenues for controlled access or, or just identifying what level of control 2479.16s - 2483.72s | is actually necessary to maintain whatever interest you have in devices safety in your 2483.72s - 2489.80s | own business, whatever. Um, I think reassessing kind of those, those parameters, uh, and then 2489.80s - 2495.32s | engaging more with the community, uh, like, like grad students can do a whole lot of really good 2495.32s - 2500.36s | work for, you know, not a whole lot of money. Like thank, thank the NSF and NIH. Like, like we 2500.36s - 2504.60s | can see via their work in other spaces, in other sectors, even other critical infrastructure 2504.60s - 2509.24s | sectors. So we have the ability, we have the talent and we know kind of what it costs. Um, 2509.24s - 2514.36s | so I think unleashing and kind of like building more work in that space could be a very cost 2514.36s - 2520.36s | effective, um, and also security effective way of getting more, more kind of progress, uh, here. 2520.36s - 2524.84s | But once again, it requires the choice to kind of open yourself up to that, that relationship and 2524.84s - 2528.60s | that community. Um, so yeah, that's, that's something that I spent a lot of time thinking 2528.60s - 2532.76s | about because you're right, right? We don't see that a lot. Like the biohacking village, very 2532.76s - 2536.68s | unique kind of in this respect, or, or there are other efforts across the nation. I'm not trying 2536.68s - 2542.76s | to discount those, but, um, we could do more. Absolutely. I, you shouldn't have to hack on 2542.76s - 2549.72s |


chunk_text:
NSF and NIH. Like, like we 2500.36s - 2504.60s | can see via their work in other spaces, in other sectors, even other critical infrastructure 2504.60s - 2509.24s | sectors. So we have the ability, we have the talent and we know kind of what it costs. Um, 2509.24s - 2514.36s | so I think unleashing and kind of like building more work in that space could be a very cost 2514.36s - 2520.36s | effective, um, and also security effective way of getting more, more kind of progress, uh, here. 2520.36s - 2524.84s | But once again, it requires the choice to kind of open yourself up to that, that relationship and 2524.84s - 2528.60s | that community. Um, so yeah, that's, that's something that I spent a lot of time thinking 2528.60s - 2532.76s | about because you're right, right? We don't see that a lot. Like the biohacking village, very 2532.76s - 2536.68s | unique kind of in this respect, or, or there are other efforts across the nation. I'm not trying 2536.68s - 2542.76s | to discount those, but, um, we could do more. Absolutely. I, you shouldn't have to hack on 2542.76s - 2549.72s | your own medical device that you own because, and that helps you be alive to do cool cutting 2549.72s - 2556.84s | edge research, right? You shouldn't have to go on eBay and buy the only device available for you 2556.84s - 2561.32s | in a device category that's 10 years old or 15 years old and has, of course you're going to find 2561.32s - 2565.72s | stuff because you can't get your hands on the latest and greatest. You know, I really wonder 2565.72s - 2572.20s | if that's holding us back. And it's just then a game of if I could get ahold of it, I could find 2572.20s - 2576.12s | something, but I'm not going to, and it's going to just float along. We miss an opportunity to 2576.12s - 2581.56s | really make some meaningful change earlier. Um, so that's a plea to the plea to the audience, 2581.56s - 2584.76s | get involved. Who would, who would take a medical device home and wrench on it if he could? 2585.32s - 2591.32s | Yeah. Hell yeah. No drug delivery pumps for you guys though. Okay. No fentanyl pumps. All right. 2592.76s - 2601.24s


chunk_text:
your own medical device that you own because, and that helps you be alive to do cool cutting 2549.72s - 2556.84s | edge research, right? You shouldn't have to go on eBay and buy the only device available for you 2556.84s - 2561.32s | in a device category that's 10 years old or 15 years old and has, of course you're going to find 2561.32s - 2565.72s | stuff because you can't get your hands on the latest and greatest. You know, I really wonder 2565.72s - 2572.20s | if that's holding us back. And it's just then a game of if I could get ahold of it, I could find 2572.20s - 2576.12s | something, but I'm not going to, and it's going to just float along. We miss an opportunity to 2576.12s - 2581.56s | really make some meaningful change earlier. Um, so that's a plea to the plea to the audience, 2581.56s - 2584.76s | get involved. Who would, who would take a medical device home and wrench on it if he could? 2585.32s - 2591.32s | Yeah. Hell yeah. No drug delivery pumps for you guys though. Okay. No fentanyl pumps. All right. 2592.76s - 2601.24s | All right. Consolidation. Okay. Here we go. Smaller. Uh, give me a round. I want an audience 2601.24s - 2605.24s | poll real quick. Raise your hand. If you think the profit margins of most hospitals in this 2605.24s - 2615.64s | country is over 20%, raise your hand. All right. Keep your hand up. 10%. 5%. 1%. Yeah. You guys 2615.64s - 2622.84s | know it's about 1% sub 1% meaning your hospital makes a profit margin probably between one and 2622.84s - 2629.24s | 4%. And then if they don't, if they screw something up, they go red. More and more hospitals are 2629.24s - 2634.04s | getting financially distressed. And I want to just hear if anyone in this audience knows what 2634.04s - 2639.48s | happens. You have a hospital system, it's in the red. And then what is it going to do to survive? 2639.48s - 2646.28s | Is it going to see more patients or become more efficient? No, it's going to get bought. 2647.32s - 2654.04s | It's going to get consolidated. What happens when hospital system A buys hospital system B? 2654.04s - 2658.60s | Do you think they're going to


chunk_text:
| All right. Consolidation. Okay. Here we go. Smaller. Uh, give me a round. I want an audience 2601.24s - 2605.24s | poll real quick. Raise your hand. If you think the profit margins of most hospitals in this 2605.24s - 2615.64s | country is over 20%, raise your hand. All right. Keep your hand up. 10%. 5%. 1%. Yeah. You guys 2615.64s - 2622.84s | know it's about 1% sub 1% meaning your hospital makes a profit margin probably between one and 2622.84s - 2629.24s | 4%. And then if they don't, if they screw something up, they go red. More and more hospitals are 2629.24s - 2634.04s | getting financially distressed. And I want to just hear if anyone in this audience knows what 2634.04s - 2639.48s | happens. You have a hospital system, it's in the red. And then what is it going to do to survive? 2639.48s - 2646.28s | Is it going to see more patients or become more efficient? No, it's going to get bought. 2647.32s - 2654.04s | It's going to get consolidated. What happens when hospital system A buys hospital system B? 2654.04s - 2658.60s | Do you think they're going to have two different, uh, entire technology stacks? No, they're going 2658.60s - 2665.08s | to unify under one stack, right? What happens when more and more hospitals are just part of 2665.08s - 2671.08s | more and more mega healthcare delivery organization conglomerates and one of them gets hit? And then 2671.08s - 2677.40s | not only is it then one or two hospitals that are down, it's 200 over four states. The question I 2677.40s - 2682.04s | have is from a national security perspective, as something that we should do from folks that are 2682.04s - 2686.12s | interested in this, making sure hospitals can function, you know, how should we look at the 2686.12s - 2690.92s | consolidation of healthcare delivery organizations when it comes to risk of catastrophic failure? 2690.92s - 2696.76s | And is there anything we can do when hospital systems try to marry one another that could 2696.76s - 2702.68s | limit this? So to the panel. Also, I'll offer, I think we are looking at this and having a lot of 2702.68s - 2706.76s | conversations about really understanding risk. I think we look at risk in not necessarily the 2706.76s -


chunk_text:
have two different, uh, entire technology stacks? No, they're going 2658.60s - 2665.08s | to unify under one stack, right? What happens when more and more hospitals are just part of 2665.08s - 2671.08s | more and more mega healthcare delivery organization conglomerates and one of them gets hit? And then 2671.08s - 2677.40s | not only is it then one or two hospitals that are down, it's 200 over four states. The question I 2677.40s - 2682.04s | have is from a national security perspective, as something that we should do from folks that are 2682.04s - 2686.12s | interested in this, making sure hospitals can function, you know, how should we look at the 2686.12s - 2690.92s | consolidation of healthcare delivery organizations when it comes to risk of catastrophic failure? 2690.92s - 2696.76s | And is there anything we can do when hospital systems try to marry one another that could 2696.76s - 2702.68s | limit this? So to the panel. Also, I'll offer, I think we are looking at this and having a lot of 2702.68s - 2706.76s | conversations about really understanding risk. I think we look at risk in not necessarily the 2706.76s - 2711.88s | right light when it comes to cybersecurity. I look at risk as a three-legged stool. There's risk 2711.88s - 2715.64s | identification. We spend a lot of time on that. There's risk mitigation. We spend a lot of time 2715.64s - 2720.52s | on that. The third leg of the stool is risk acceptance. And we don't spend enough time 2720.52s - 2725.72s | understanding the risks that we're accepting in our organizations by not investing in 2725.72s - 2730.60s | cybersecurity or modernization and infrastructure. That risk acceptance is not the CISO. 2731.24s - 2735.96s | That risk acceptance is the CEOs and the boards of directors of organizations that are deciding 2735.96s - 2742.68s | to not invest. I get the margins issue. I worked in healthcare. We were never even in the one percent, 2742.68s - 2745.48s | so I think that's a great... We would have loved to have been in the one percent. 2746.84s - 2751.40s | So I think that there's those types of challenges that folks are balancing against, but people need 2751.40s - 2755.72s | to understand the risks that they're accepting. I will say that we are hearing more


chunk_text:
2711.88s | right light when it comes to cybersecurity. I look at risk as a three-legged stool. There's risk 2711.88s - 2715.64s | identification. We spend a lot of time on that. There's risk mitigation. We spend a lot of time 2715.64s - 2720.52s | on that. The third leg of the stool is risk acceptance. And we don't spend enough time 2720.52s - 2725.72s | understanding the risks that we're accepting in our organizations by not investing in 2725.72s - 2730.60s | cybersecurity or modernization and infrastructure. That risk acceptance is not the CISO. 2731.24s - 2735.96s | That risk acceptance is the CEOs and the boards of directors of organizations that are deciding 2735.96s - 2742.68s | to not invest. I get the margins issue. I worked in healthcare. We were never even in the one percent, 2742.68s - 2745.48s | so I think that's a great... We would have loved to have been in the one percent. 2746.84s - 2751.40s | So I think that there's those types of challenges that folks are balancing against, but people need 2751.40s - 2755.72s | to understand the risks that they're accepting. I will say that we are hearing more healthcare 2755.72s - 2762.20s | organizations talking about tech debt and cyber risk in the M&A process. They're having these 2762.20s - 2766.60s | discussions of saying, we want to buy this healthcare system or this hospital, and we know 2766.60s - 2772.36s | that it's going to cost us 2 million, 3 million, 4 million to get their IT to the standards that we 2772.36s - 2777.32s | have set within our organization. And they're building that into the M&A discussion when it 2777.32s - 2781.72s | comes to that. Now, that being said, that's a small fraction of the conversations that are 2781.72s - 2785.08s | happening. So I think it's a multi-pronged approach. One, we want to make sure that we're 2785.08s - 2790.60s | able to get that message out to folks and change the way that we're looking at M&A within healthcare 2790.60s - 2796.04s | so that people are factoring in tech debt and cybersecurity as part of that dialogue. And I 2796.04s - 2800.28s | think the other piece of it is making sure that we understand, going back to the first question 2800.28s - 2805.40s | about mapping out the sector, where


chunk_text:
healthcare 2755.72s - 2762.20s | organizations talking about tech debt and cyber risk in the M&A process. They're having these 2762.20s - 2766.60s | discussions of saying, we want to buy this healthcare system or this hospital, and we know 2766.60s - 2772.36s | that it's going to cost us 2 million, 3 million, 4 million to get their IT to the standards that we 2772.36s - 2777.32s | have set within our organization. And they're building that into the M&A discussion when it 2777.32s - 2781.72s | comes to that. Now, that being said, that's a small fraction of the conversations that are 2781.72s - 2785.08s | happening. So I think it's a multi-pronged approach. One, we want to make sure that we're 2785.08s - 2790.60s | able to get that message out to folks and change the way that we're looking at M&A within healthcare 2790.60s - 2796.04s | so that people are factoring in tech debt and cybersecurity as part of that dialogue. And I 2796.04s - 2800.28s | think the other piece of it is making sure that we understand, going back to the first question 2800.28s - 2805.40s | about mapping out the sector, where are those key dependencies where something is, you know, 2806.12s - 2811.56s | we know this with the HR, we know this obviously with change, but there's other types of events 2811.56s - 2816.68s | that we don't know what's out there, where there's these entities that have such large market share 2816.68s - 2821.32s | that the impact of one becomes an impact to more than we can tolerate in healthcare. We need to 2821.32s - 2826.52s | know that so we can start having those discussions of buying down that risk or going in collectively 2826.52s - 2830.92s | and accepting that risk. And we have not been able to do that effectively yet where we need to 2830.92s - 2840.30s | in the healthcare sector. Oh, mergers and acquisitions. Sorry. Thank you. Anyone else? 2841.66s - 2849.66s | I'd say, in terms of consolidation, I'd say, what can we learn from other international models 2849.66s - 2856.94s | where there are single payer systems that have large networks of facilities? Are there things 2856.94s - 2862.38s | that we can learn to address some of those risks based off of what we've seen them do well or


chunk_text:
are those key dependencies where something is, you know, 2806.12s - 2811.56s | we know this with the HR, we know this obviously with change, but there's other types of events 2811.56s - 2816.68s | that we don't know what's out there, where there's these entities that have such large market share 2816.68s - 2821.32s | that the impact of one becomes an impact to more than we can tolerate in healthcare. We need to 2821.32s - 2826.52s | know that so we can start having those discussions of buying down that risk or going in collectively 2826.52s - 2830.92s | and accepting that risk. And we have not been able to do that effectively yet where we need to 2830.92s - 2840.30s | in the healthcare sector. Oh, mergers and acquisitions. Sorry. Thank you. Anyone else? 2841.66s - 2849.66s | I'd say, in terms of consolidation, I'd say, what can we learn from other international models 2849.66s - 2856.94s | where there are single payer systems that have large networks of facilities? Are there things 2856.94s - 2862.38s | that we can learn to address some of those risks based off of what we've seen them do well or them 2862.38s - 2869.66s | have issues with? And how can we adopt what has worked well or improve upon what hasn't? 2870.94s - 2877.34s | But I'd say it's definitely something we need to pay careful attention to and see what protections 2877.90s - 2885.50s | can be in place to isolate facilities in case one gets hit, to ensure that continuity of care, 2885.50s - 2891.98s | especially if it's in an overlapping region, you don't want to lose an entire region of facilities 2893.50s - 2900.62s | based off of it hitting the central core facility or just affecting the entire network. 2900.62s - 2908.62s | So how can we get better detection and automated response capabilities in order 2908.62s - 2914.52s | to cut off those networks when exposed? All right. I want to make sure we can get 2914.52s - 2918.36s | through some questions here. And this has a whistleblower component, I think, 2918.36s - 2921.80s | which is the interesting part. I'd like to pull on that a little bit in here. 2923.96s - 2928.68s | For years, we have known very little in what happens inside hospitals that have been hit 2928.68s


chunk_text:
them 2862.38s - 2869.66s | have issues with? And how can we adopt what has worked well or improve upon what hasn't? 2870.94s - 2877.34s | But I'd say it's definitely something we need to pay careful attention to and see what protections 2877.90s - 2885.50s | can be in place to isolate facilities in case one gets hit, to ensure that continuity of care, 2885.50s - 2891.98s | especially if it's in an overlapping region, you don't want to lose an entire region of facilities 2893.50s - 2900.62s | based off of it hitting the central core facility or just affecting the entire network. 2900.62s - 2908.62s | So how can we get better detection and automated response capabilities in order 2908.62s - 2914.52s | to cut off those networks when exposed? All right. I want to make sure we can get 2914.52s - 2918.36s | through some questions here. And this has a whistleblower component, I think, 2918.36s - 2921.80s | which is the interesting part. I'd like to pull on that a little bit in here. 2923.96s - 2928.68s | For years, we have known very little in what happens inside hospitals that have been hit 2928.68s - 2934.12s | with ransomware. Every once in a while, you'll get a news report that says an attack happened, 2934.12s - 2938.12s | and you'll hear some updated news reports that the attack's still going on. Maybe you'll get 2938.12s - 2942.84s | an anonymous quote from a doctor or nurse that worked at the hospital. But for longest times, 2942.84s - 2947.48s | we had no idea, really, with rare exception. Maybe, I'm just going to shout out University 2947.48s - 2951.80s | of Vermont, right? They've been incredibly transparent in their attack. Well, as a 2951.80s - 2957.80s | consequence of not sharing that information very openly and exhaustively is we don't get lessons 2957.80s - 2962.12s | learned, right? We don't know what happened when they're taking care of their diabetic patients 2962.12s - 2967.80s | that were in a crisis or their heart attacks or their strokes. We don't really learn like we 2967.80s - 2974.44s | should. And there are some organizations like ISACs and these types of things. But clearly, 2975.00s - 2985.07s | there seems to be an information vacuum. Do we offer some additional legal protections, 2985.07s - 2990.43s | some


chunk_text:
- 2934.12s | with ransomware. Every once in a while, you'll get a news report that says an attack happened, 2934.12s - 2938.12s | and you'll hear some updated news reports that the attack's still going on. Maybe you'll get 2938.12s - 2942.84s | an anonymous quote from a doctor or nurse that worked at the hospital. But for longest times, 2942.84s - 2947.48s | we had no idea, really, with rare exception. Maybe, I'm just going to shout out University 2947.48s - 2951.80s | of Vermont, right? They've been incredibly transparent in their attack. Well, as a 2951.80s - 2957.80s | consequence of not sharing that information very openly and exhaustively is we don't get lessons 2957.80s - 2962.12s | learned, right? We don't know what happened when they're taking care of their diabetic patients 2962.12s - 2967.80s | that were in a crisis or their heart attacks or their strokes. We don't really learn like we 2967.80s - 2974.44s | should. And there are some organizations like ISACs and these types of things. But clearly, 2975.00s - 2985.07s | there seems to be an information vacuum. Do we offer some additional legal protections, 2985.07s - 2990.43s | some type of additional efforts that we can do to make health systems feel more comfortable about 2990.43s - 2995.87s | talking about their failures so other people can learn from it? To the audience, or sorry, 2995.87s - 3002.59s | to the panel. So, I think you see in other domains where people make upfront disclosures 3002.59s - 3007.71s | that say if they are in violation of some sort of tenant, like foreign corrupt practices, 3007.71s - 3013.07s | that there will be leniencies in terms of the fees that they might incur. But I think it is 3013.07s - 3018.19s | to this point of like getting that board buy-in, getting that executive buy-in to say like mistakes 3018.19s - 3023.39s | are going to be made and we're here to fix them. And that there's an immense amount of power 3023.47s - 3029.39s | in deconstructing the narrative of exactly what went wrong and the details of that. Because even 3029.39s - 3034.43s | for a cybersecurity failure, it's not just one or two things. It's probably a list of 3034.43s - 3041.07s | 30 different decisions that were made. And being able to have really clear


chunk_text:
type of additional efforts that we can do to make health systems feel more comfortable about 2990.43s - 2995.87s | talking about their failures so other people can learn from it? To the audience, or sorry, 2995.87s - 3002.59s | to the panel. So, I think you see in other domains where people make upfront disclosures 3002.59s - 3007.71s | that say if they are in violation of some sort of tenant, like foreign corrupt practices, 3007.71s - 3013.07s | that there will be leniencies in terms of the fees that they might incur. But I think it is 3013.07s - 3018.19s | to this point of like getting that board buy-in, getting that executive buy-in to say like mistakes 3018.19s - 3023.39s | are going to be made and we're here to fix them. And that there's an immense amount of power 3023.47s - 3029.39s | in deconstructing the narrative of exactly what went wrong and the details of that. Because even 3029.39s - 3034.43s | for a cybersecurity failure, it's not just one or two things. It's probably a list of 3034.43s - 3041.07s | 30 different decisions that were made. And being able to have really clear granularity 3041.07s - 3048.59s | of who made what decisions, who was affected, who was unaware, whatever those details are, 3048.59s - 3054.51s | being very explicit, very clear, and really being able to dig in the weeds of those retrospective 3054.51s - 3060.35s | analysis. And not only sharing them internally with those organizations, but also externally 3060.99s - 3067.15s | to other people who work in the cybersecurity industry is immensely helpful. But I think 3067.15s - 3073.71s | psychologically very hard, right? It's hard even though you may be valued by other cybersecurity 3073.71s - 3079.31s | professionals for being transparent and open and admitting a mistake. The public perception 3079.31s - 3085.63s | of that could be seen while you were in negligent or everything else. And that sort of shift 3085.63s - 3091.87s | in people's perception of when people make mistakes is also a bit of a challenge there. 3091.87s - 3096.03s | So you can see that there's maybe some sort of incentivization structure that you can create to 3096.03s - 3100.99s | say you'll get leniency if you're very clear at reporting what went wrong and how it went wrong 3100.99s -


chunk_text:
granularity 3041.07s - 3048.59s | of who made what decisions, who was affected, who was unaware, whatever those details are, 3048.59s - 3054.51s | being very explicit, very clear, and really being able to dig in the weeds of those retrospective 3054.51s - 3060.35s | analysis. And not only sharing them internally with those organizations, but also externally 3060.99s - 3067.15s | to other people who work in the cybersecurity industry is immensely helpful. But I think 3067.15s - 3073.71s | psychologically very hard, right? It's hard even though you may be valued by other cybersecurity 3073.71s - 3079.31s | professionals for being transparent and open and admitting a mistake. The public perception 3079.31s - 3085.63s | of that could be seen while you were in negligent or everything else. And that sort of shift 3085.63s - 3091.87s | in people's perception of when people make mistakes is also a bit of a challenge there. 3091.87s - 3096.03s | So you can see that there's maybe some sort of incentivization structure that you can create to 3096.03s - 3100.99s | say you'll get leniency if you're very clear at reporting what went wrong and how it went wrong 3100.99s - 3107.15s | in very, very specified details. Or alternatively, again, it's like this is a deliberate decision 3108.03s - 3112.75s | typically by people in positions of leadership to say transparency is important to us. 3112.75s - 3118.19s | Being able to say we are engineers, we are going to fail, that is a nature of engineering, but we 3118.19s - 3124.59s | are also here to fix. And this is how we fixed it. And for the benefit of our industry, here is the 3124.59s - 3131.79s | details of how we resolved that issue. And I think having those case studies is crucially 3131.79s - 3137.39s | important for basically any field that you're really in. But it's a tricky problem, right? 3137.39s - 3144.43s | Because it's a public perception, it's a liability issue or a perceived liability issue. And it's 3144.43s - 3150.51s | like how do you overcome those hurdles is more of a people problem I would see than a technical 3151.47s - 3157.31s | problem. Yeah, it's been a technical problem at the end of the day. 3158.99s - 3164.83s | I think kind of building on that, like looking at the FAA


chunk_text:
3107.15s | in very, very specified details. Or alternatively, again, it's like this is a deliberate decision 3108.03s - 3112.75s | typically by people in positions of leadership to say transparency is important to us. 3112.75s - 3118.19s | Being able to say we are engineers, we are going to fail, that is a nature of engineering, but we 3118.19s - 3124.59s | are also here to fix. And this is how we fixed it. And for the benefit of our industry, here is the 3124.59s - 3131.79s | details of how we resolved that issue. And I think having those case studies is crucially 3131.79s - 3137.39s | important for basically any field that you're really in. But it's a tricky problem, right? 3137.39s - 3144.43s | Because it's a public perception, it's a liability issue or a perceived liability issue. And it's 3144.43s - 3150.51s | like how do you overcome those hurdles is more of a people problem I would see than a technical 3151.47s - 3157.31s | problem. Yeah, it's been a technical problem at the end of the day. 3158.99s - 3164.83s | I think kind of building on that, like looking at the FAA and how we deal with aviation incidents, 3164.83s - 3169.47s | I mean, I think there was a recognition that the entire industry, like if people did not feel safe 3169.47s - 3174.83s | flying, that entire sector would collapse. And so the need for transparency, the processes that 3174.83s - 3179.87s | have been put in place, like are they perfect? Probably not. I'm not an expert in that field. 3179.87s - 3183.31s | But there is a high degree of industry and government cooperation. There's a high degree 3183.31s - 3190.75s | of transparency. There's a high degree of forensic capacity built into the systems that we use to 3190.75s - 3197.95s | ensure commercial flight. Or like the NTSB to a lesser degree. But things that we have decided 3197.95s - 3204.75s | are necessary for the economy, for the nation to move forward every day. We find a way to achieve 3204.75s - 3208.99s | more transparency and more cooperation. And so it'd be really interesting just to see 3209.63s - 3215.79s | how can we do that for healthcare? Because this is also a necessity. Very, very complex one. 3217.63s - 3222.11s | But I


chunk_text:
and how we deal with aviation incidents, 3164.83s - 3169.47s | I mean, I think there was a recognition that the entire industry, like if people did not feel safe 3169.47s - 3174.83s | flying, that entire sector would collapse. And so the need for transparency, the processes that 3174.83s - 3179.87s | have been put in place, like are they perfect? Probably not. I'm not an expert in that field. 3179.87s - 3183.31s | But there is a high degree of industry and government cooperation. There's a high degree 3183.31s - 3190.75s | of transparency. There's a high degree of forensic capacity built into the systems that we use to 3190.75s - 3197.95s | ensure commercial flight. Or like the NTSB to a lesser degree. But things that we have decided 3197.95s - 3204.75s | are necessary for the economy, for the nation to move forward every day. We find a way to achieve 3204.75s - 3208.99s | more transparency and more cooperation. And so it'd be really interesting just to see 3209.63s - 3215.79s | how can we do that for healthcare? Because this is also a necessity. Very, very complex one. 3217.63s - 3222.11s | But I think the fundamental kind of like problem and maybe the solution looks similar. 3225.64s - 3229.48s | All right. I've gotten the less than five minutes. I know we had talked a little bit about a Q&A, 3229.48s - 3231.96s | but I don't think we're going to be able to take a Q&A. Is that correct? 3233.24s - 3236.20s | Yeah, unfortunately not. Blame this person. I'm just kidding. Blame me, 3236.84s - 3240.60s | the monitor. What I will offer is I'll be available in the back. We'll be respectful 3240.68s - 3244.28s | to the next speakers. I can't guarantee any of these folks that are very busy, 3244.28s - 3248.04s | they may or may not be able to answer some questions. But I want to say from the bottom 3248.04s - 3253.24s | of my heart, and I hope you out there agree, thank you so much for coming and giving us 3253.24s - 3256.92s | your knowledge today on this very complicated topic. Everyone give him a round of applause.


chunk_text:
think the fundamental kind of like problem and maybe the solution looks similar. 3225.64s - 3229.48s | All right. I've gotten the less than five minutes. I know we had talked a little bit about a Q&A, 3229.48s - 3231.96s | but I don't think we're going to be able to take a Q&A. Is that correct? 3233.24s - 3236.20s | Yeah, unfortunately not. Blame this person. I'm just kidding. Blame me, 3236.84s - 3240.60s | the monitor. What I will offer is I'll be available in the back. We'll be respectful 3240.68s - 3244.28s | to the next speakers. I can't guarantee any of these folks that are very busy, 3244.28s - 3248.04s | they may or may not be able to answer some questions. But I want to say from the bottom 3248.04s - 3253.24s | of my heart, and I hope you out there agree, thank you so much for coming and giving us 3253.24s - 3256.92s | your knowledge today on this very complicated topic. Everyone give him a round of applause.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=WC-tY-gEIPc", "title": "DEF CON 32 - Hacker vs AI perspectives from an ex spy - Harriet Farlow", "description": "The convergence of Artificial Intelligence (AI) and national security not only fuels international discourse but also inspires narratives within popular culture. Harriet is no stranger to these myths, as an ex-intelligence professional who specialized in applying machine learning to cyber security. In fact, she likes to lean into them. This makes her previous bosses nervous, so she uses pop culture as the lens through which to communicate her insights - and in this talk she utilizes the worlds of Ghost in the Shell, Neuromancer and Mission Impossible.\n\nThrough these stories, as well as her own decade of experience working at the intersection of artificial intelligence and cyber security, Harriet discusses the extent to which fears surrounding AI systems are applicable to real life national security settings. From cyber warfare to AI-driven surveillance, she unravels the interplay between hackers, AI, and government agencies. This session is interactive, with demos of how these AI systems actually work under the hood, as well as discussion time. Blur the lines between human and machine, and understand how you can contribute your skills to prevent our own modern day Puppet Master.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2439, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.24s | This text was transcribed using whisper model: large-v2 Okay. We're starting. Um, it was really wild walking past a queue to get into this room 5.24s - 10.80s | to see me talk. I mean, I, I know I'm, I'm obviously ex intelligence, but I'm not going 10.80s - 16.20s | to be divulging any state secrets here. In fact, definitely the opposite because obviously 16.20s - 22.16s | like someone is watching this, so I don't want to get in big trouble or arrested. Um, 22.16s - 28.36s | but it's, it's amazing to see you all here. So thank you. Um, so this is a talk about 28.36s - 35.16s | the intersection of AI and security specifically from the national security lens. Um, this 35.16s - 40.40s | is a policy village talk that is up here on the creator stage. So there is a policy slant 40.40s - 46.60s | to it. So if you're expecting to see cool like hacking techniques or how to evade an 46.60s - 52.68s | APT, this is not the


chunk_text:
own modern day Puppet Master.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2439, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 5.24s | This text was transcribed using whisper model: large-v2 Okay. We're starting. Um, it was really wild walking past a queue to get into this room 5.24s - 10.80s | to see me talk. I mean, I, I know I'm, I'm obviously ex intelligence, but I'm not going 10.80s - 16.20s | to be divulging any state secrets here. In fact, definitely the opposite because obviously 16.20s - 22.16s | like someone is watching this, so I don't want to get in big trouble or arrested. Um, 22.16s - 28.36s | but it's, it's amazing to see you all here. So thank you. Um, so this is a talk about 28.36s - 35.16s | the intersection of AI and security specifically from the national security lens. Um, this 35.16s - 40.40s | is a policy village talk that is up here on the creator stage. So there is a policy slant 40.40s - 46.60s | to it. So if you're expecting to see cool like hacking techniques or how to evade an 46.60s - 52.68s | APT, this is not the talk. Um, although maybe I will talk about it. Um, but I hope you're 52.68s - 56.68s | all here because you're interested in policy in some way. Could I get a show of hands if 56.72s - 62.48s | you are like a policy person? Okay. That's good. That's good. And what if you're more 62.48s - 68.64s | of a technical person, like a cyber or an AI person? Okay. So probably a bit more, but 68.64s - 73.68s | a good mix. Okay. That's okay. Um, hopefully this is interesting for you. I don't know. 73.68s - 80.08s | Um, we'll see. So who am I? Um, my name's Harriet Farlow. I've worked at the intersection 80.08s - 86.72s | of artificial intelligence and security for about 10 years now. My undergraduate degree 86.72s - 92.00s | was in physics and like many physicists, I didn't really know what to do with it. So 92.00s - 98.68s | I ended up working in data science. Why is there a laugh there? Um, so I ended up working 98.68s - 104.80s | in data science, um, mostly specializing in defense projects, um, in Australia. So I spent 104.80s


chunk_text:
talk. Um, although maybe I will talk about it. Um, but I hope you're 52.68s - 56.68s | all here because you're interested in policy in some way. Could I get a show of hands if 56.72s - 62.48s | you are like a policy person? Okay. That's good. That's good. And what if you're more 62.48s - 68.64s | of a technical person, like a cyber or an AI person? Okay. So probably a bit more, but 68.64s - 73.68s | a good mix. Okay. That's okay. Um, hopefully this is interesting for you. I don't know. 73.68s - 80.08s | Um, we'll see. So who am I? Um, my name's Harriet Farlow. I've worked at the intersection 80.08s - 86.72s | of artificial intelligence and security for about 10 years now. My undergraduate degree 86.72s - 92.00s | was in physics and like many physicists, I didn't really know what to do with it. So 92.00s - 98.68s | I ended up working in data science. Why is there a laugh there? Um, so I ended up working 98.68s - 104.80s | in data science, um, mostly specializing in defense projects, um, in Australia. So I spent 104.80s - 109.48s | a year working on the patrol boats in Darwin. If anyone's familiar with Darwin, it's, it's 109.48s - 113.96s | a small town far North in Australia where there's obviously a lot of military activity 113.96s - 118.76s | and crocodiles and that's sort of what's going on, but an insane number of British backpackers 118.76s - 123.88s | and it's, it's, it's loose all the time. Um, and I also worked on sort of air force projects 123.88s - 130.40s | where we were augmenting people's roles with, um, like robotic process automation. Um, ideally, 130.40s - 134.80s | hopefully not to, you know, take people's jobs away. Right. But just to make them not 134.80s - 141.08s | have to do the, the uncool bits. Um, I worked there for a while, um, had my, you know, quarter 141.08s - 145.56s | life crisis ended up working at a startup in New York city, which is really cool. And 145.56s - 152.56s | I was also working on sort of advising large companies in the United States on AI and cybersecurity. 152.56s - 158.28s | Uh, unfortunately during COVID I had to move back home.


chunk_text:
- 109.48s | a year working on the patrol boats in Darwin. If anyone's familiar with Darwin, it's, it's 109.48s - 113.96s | a small town far North in Australia where there's obviously a lot of military activity 113.96s - 118.76s | and crocodiles and that's sort of what's going on, but an insane number of British backpackers 118.76s - 123.88s | and it's, it's, it's loose all the time. Um, and I also worked on sort of air force projects 123.88s - 130.40s | where we were augmenting people's roles with, um, like robotic process automation. Um, ideally, 130.40s - 134.80s | hopefully not to, you know, take people's jobs away. Right. But just to make them not 134.80s - 141.08s | have to do the, the uncool bits. Um, I worked there for a while, um, had my, you know, quarter 141.08s - 145.56s | life crisis ended up working at a startup in New York city, which is really cool. And 145.56s - 152.56s | I was also working on sort of advising large companies in the United States on AI and cybersecurity. 152.56s - 158.28s | Uh, unfortunately during COVID I had to move back home. Um, and the Australian government 158.28s - 163.44s | was the only people hiring. So that's how I ended up working in intelligence. Um, not 163.44s - 167.08s | to make it sound like I didn't want to, I was really grateful to, and it's something 167.08s - 172.08s | that I'd always been really interested in. Um, and I guess COVID just forced me into 172.08s - 177.12s | that opportunity. Um, but it was really great. I worked at the Australian signals directorate 177.12s - 182.76s | in Australia, which is our equivalent of the NSA. I always get scared about saying the 182.76s - 187.64s | wrong thing. So yeah, like this is not going to be the spiciest talk obviously. Um, because 187.64s - 191.64s | I'm scared of saying the wrong thing. So this is, this is ASD and this is what they do. 191.96s - 195.52s | They're the Australian government intelligence agency responsible for foreign signals, intelligence 195.52s - 200.68s | and cybersecurity. And they do all those things. And so over the time I was working there, 200.68s - 206.12s | I was mostly a data scientist in the cybersecurity teams. Um,


chunk_text:
Um, and the Australian government 158.28s - 163.44s | was the only people hiring. So that's how I ended up working in intelligence. Um, not 163.44s - 167.08s | to make it sound like I didn't want to, I was really grateful to, and it's something 167.08s - 172.08s | that I'd always been really interested in. Um, and I guess COVID just forced me into 172.08s - 177.12s | that opportunity. Um, but it was really great. I worked at the Australian signals directorate 177.12s - 182.76s | in Australia, which is our equivalent of the NSA. I always get scared about saying the 182.76s - 187.64s | wrong thing. So yeah, like this is not going to be the spiciest talk obviously. Um, because 187.64s - 191.64s | I'm scared of saying the wrong thing. So this is, this is ASD and this is what they do. 191.96s - 195.52s | They're the Australian government intelligence agency responsible for foreign signals, intelligence 195.52s - 200.68s | and cybersecurity. And they do all those things. And so over the time I was working there, 200.68s - 206.12s | I was mostly a data scientist in the cybersecurity teams. Um, and by the time I left, I was acting 206.12s - 211.72s | as a technical director on one of their sort of AI streams. And through this job, I got 211.72s - 217.88s | to travel to Canada and the USA and lead some of the technical work around AI in that space 217.92s - 223.88s | there as well, which is really great. Um, fantastic organization, fantastic people believed 223.88s - 228.16s | in the mission wholeheartedly, but I guess the entrepreneurial spirit never really left 228.16s - 233.20s | me. Um, and while I was there, I started doing my PhD in adversarial machine learning and 233.20s - 240.20s | investigating ways to hack models and basically found that in the, like the, the, the private 240.20s - 244.24s | sphere, there was just not that much activity happening in that space, even though there 244.28s - 249.96s | was, um, you know, that it represented a real threat. So I left my government job and for 249.96s - 255.56s | the last year I've been running an AI security company called Maleba Security Labs. Um, we've 255.56s - 259.72s | just received funding to start building


chunk_text:
and by the time I left, I was acting 206.12s - 211.72s | as a technical director on one of their sort of AI streams. And through this job, I got 211.72s - 217.88s | to travel to Canada and the USA and lead some of the technical work around AI in that space 217.92s - 223.88s | there as well, which is really great. Um, fantastic organization, fantastic people believed 223.88s - 228.16s | in the mission wholeheartedly, but I guess the entrepreneurial spirit never really left 228.16s - 233.20s | me. Um, and while I was there, I started doing my PhD in adversarial machine learning and 233.20s - 240.20s | investigating ways to hack models and basically found that in the, like the, the, the private 240.20s - 244.24s | sphere, there was just not that much activity happening in that space, even though there 244.28s - 249.96s | was, um, you know, that it represented a real threat. So I left my government job and for 249.96s - 255.56s | the last year I've been running an AI security company called Maleba Security Labs. Um, we've 255.56s - 259.72s | just received funding to start building a tech product, which is exciting, especially 259.72s - 264.60s | because there's, there's so much grind. It's, it's a long time, but that's who I am. Um, 264.60s - 270.44s | I also have a social media presence at Harriet Hacks, which is not amazing, but I'm trying. 270.48s - 277.20s | Um, I'm there on YouTube. Um, you can reach out to me on, uh, like X and other platforms 277.20s - 282.08s | and we have a podcast now, which is really cringy, but, um, anyway, you know, as an 282.08s - 286.96s | entrepreneur, you just got to do what you got to do. Um, so I've been doing quite a lot of 286.96s - 294.76s | research at the intersection of AI and security for a while. This is my fourth talk this 294.76s - 300.96s | week. So if I am a bit like foggy or tired, I apologize. It's been a massive week and I 300.96s - 306.36s | don't think I've ever needed a drink so much as I will right after this talk. Um, but 306.36s - 310.68s | yesterday, um, well, I spoke at B-Sides and then the main stage


chunk_text:
a tech product, which is exciting, especially 259.72s - 264.60s | because there's, there's so much grind. It's, it's a long time, but that's who I am. Um, 264.60s - 270.44s | I also have a social media presence at Harriet Hacks, which is not amazing, but I'm trying. 270.48s - 277.20s | Um, I'm there on YouTube. Um, you can reach out to me on, uh, like X and other platforms 277.20s - 282.08s | and we have a podcast now, which is really cringy, but, um, anyway, you know, as an 282.08s - 286.96s | entrepreneur, you just got to do what you got to do. Um, so I've been doing quite a lot of 286.96s - 294.76s | research at the intersection of AI and security for a while. This is my fourth talk this 294.76s - 300.96s | week. So if I am a bit like foggy or tired, I apologize. It's been a massive week and I 300.96s - 306.36s | don't think I've ever needed a drink so much as I will right after this talk. Um, but 306.36s - 310.68s | yesterday, um, well, I spoke at B-Sides and then the main stage yesterday and the AI 310.68s - 317.64s | village yesterday, um, on some of the methods that are used and new methods to, uh, hack 317.68s - 322.40s | facial recognition AI models. Um, and that's in the field of adversarial machine learning, 322.40s - 327.80s | which is my PhD topic. And in particular, um, the, the content I was talking about was in 327.80s - 333.04s | the context of urban camouflage. That's sort of how I envisioned it, um, at the time that 333.04s - 338.00s | I, they created that method. Um, but basically the idea is that machine learning models are 338.00s - 342.60s | pretty brittle and easily exploitable and that most of the organizations that are 342.60s - 348.44s | leveraging machine learning, um, are relying on pretty insecure models, even though lots 348.44s - 353.52s | of organizations are doing the right thing. Like it's, it's really cool to see, um, AIXCC 353.52s - 358.00s | if you've been there and all the companies like, um, Google, Microsoft, Anthropic, Open 358.00s - 362.56s | AI that are working on secure AI. But for all the other organizations that are creating 362.56s -


chunk_text:
yesterday and the AI 310.68s - 317.64s | village yesterday, um, on some of the methods that are used and new methods to, uh, hack 317.68s - 322.40s | facial recognition AI models. Um, and that's in the field of adversarial machine learning, 322.40s - 327.80s | which is my PhD topic. And in particular, um, the, the content I was talking about was in 327.80s - 333.04s | the context of urban camouflage. That's sort of how I envisioned it, um, at the time that 333.04s - 338.00s | I, they created that method. Um, but basically the idea is that machine learning models are 338.00s - 342.60s | pretty brittle and easily exploitable and that most of the organizations that are 342.60s - 348.44s | leveraging machine learning, um, are relying on pretty insecure models, even though lots 348.44s - 353.52s | of organizations are doing the right thing. Like it's, it's really cool to see, um, AIXCC 353.52s - 358.00s | if you've been there and all the companies like, um, Google, Microsoft, Anthropic, Open 358.00s - 362.56s | AI that are working on secure AI. But for all the other organizations that are creating 362.56s - 367.68s | AI products, there's no real mandate for them to actually be secure. And, and that's part 367.68s - 372.12s | of the problem. Um, some other talks were showing that, but I also do research, um, 372.12s - 378.36s | on policy as well and applying that in the policy sort of lens. And maybe it sounds really 378.36s - 384.40s | bad, but I'm far more excited to deliver this talk than the other ones. Um, I, I never 384.40s - 389.52s | really thought that I would consider myself a policy nerd. It always seemed pretty dry. 389.52s - 394.52s | Um, especially when you work in the bureaucracy and you have to try and create policy, like 394.52s - 399.64s | that just sucks. But it's actually really interesting to think about the, the impacts 399.64s - 404.00s | of policy because it is real. Um, so now if someone called me a policy nerd, I would probably 404.00s - 409.08s | actually be quite happy about that, uh, which is an identity crisis slash shift I guess 409.08s - 414.72s | I've gone through. But that sort of leads us into the objectives of


chunk_text:
367.68s | AI products, there's no real mandate for them to actually be secure. And, and that's part 367.68s - 372.12s | of the problem. Um, some other talks were showing that, but I also do research, um, 372.12s - 378.36s | on policy as well and applying that in the policy sort of lens. And maybe it sounds really 378.36s - 384.40s | bad, but I'm far more excited to deliver this talk than the other ones. Um, I, I never 384.40s - 389.52s | really thought that I would consider myself a policy nerd. It always seemed pretty dry. 389.52s - 394.52s | Um, especially when you work in the bureaucracy and you have to try and create policy, like 394.52s - 399.64s | that just sucks. But it's actually really interesting to think about the, the impacts 399.64s - 404.00s | of policy because it is real. Um, so now if someone called me a policy nerd, I would probably 404.00s - 409.08s | actually be quite happy about that, uh, which is an identity crisis slash shift I guess 409.08s - 414.72s | I've gone through. But that sort of leads us into the objectives of this talk, which 414.72s - 419.20s | I hope it's not too theoretical for you. It kind of has to be, but I find it really interesting 419.20s - 422.84s | actually. So maybe if there's something you take away from this, it's that policy can 422.84s - 428.68s | actually be quite interesting and important. Um, so I'm going to cover some of the different 428.68s - 435.68s | ways that AI, um, is used in a national security context, cyber defense and offense. I'm sure 435.68s - 439.84s | this will not be surprising to you at all. Um, so I'll just go over that lightly, but 439.84s - 444.08s | then I'll talk about some of the national security implications from that, uh, from 444.08s - 448.88s | my perspective. And then you might be disappointed by this as well, but I'm going to talk about 448.88s - 452.80s | security theory because I actually find it really interesting. And I think it's really 452.80s - 459.44s | interesting to see how traditional security theory at stemming from sort of military sciences 459.44s - 465.44s | has moved into cyber security, but hasn't really moved into AI


chunk_text:
this talk, which 414.72s - 419.20s | I hope it's not too theoretical for you. It kind of has to be, but I find it really interesting 419.20s - 422.84s | actually. So maybe if there's something you take away from this, it's that policy can 422.84s - 428.68s | actually be quite interesting and important. Um, so I'm going to cover some of the different 428.68s - 435.68s | ways that AI, um, is used in a national security context, cyber defense and offense. I'm sure 435.68s - 439.84s | this will not be surprising to you at all. Um, so I'll just go over that lightly, but 439.84s - 444.08s | then I'll talk about some of the national security implications from that, uh, from 444.08s - 448.88s | my perspective. And then you might be disappointed by this as well, but I'm going to talk about 448.88s - 452.80s | security theory because I actually find it really interesting. And I think it's really 452.80s - 459.44s | interesting to see how traditional security theory at stemming from sort of military sciences 459.44s - 465.44s | has moved into cyber security, but hasn't really moved into AI security yet. And, and 465.44s - 472.44s | how we can sort of encourage that change to make sure that AI also is secure, um, as, 472.44s - 479.16s | as our other, other, as our other disciplines. But first, so this is an AI, uh, pop the, 479.20s - 483.92s | the policy village talk and they told me in submitting this talk that it had to be interactive 483.92s - 489.08s | with the audience and then it had to encourage discussion. So I, I feel like maybe that's 489.08s - 494.08s | a bit different as a creative stage like this. I think like maybe in the policy area, that's 494.08s - 498.64s | a bit easier, but I do still think it's important actually. So maybe take 30 seconds and say 498.64s - 504.00s | hello to the person next to you. Um, you can explain why you're interested in policy and 504.00s - 507.36s | then note your favorite sci-fi movie. If you read the description, obviously I'm talking 507.36s - 511.28s | about sort of leaning into sci-fi here. So I'm going to break for 30 seconds and you, 511.28s - 581.83s | you


chunk_text:
security yet. And, and 465.44s - 472.44s | how we can sort of encourage that change to make sure that AI also is secure, um, as, 472.44s - 479.16s | as our other, other, as our other disciplines. But first, so this is an AI, uh, pop the, 479.20s - 483.92s | the policy village talk and they told me in submitting this talk that it had to be interactive 483.92s - 489.08s | with the audience and then it had to encourage discussion. So I, I feel like maybe that's 489.08s - 494.08s | a bit different as a creative stage like this. I think like maybe in the policy area, that's 494.08s - 498.64s | a bit easier, but I do still think it's important actually. So maybe take 30 seconds and say 498.64s - 504.00s | hello to the person next to you. Um, you can explain why you're interested in policy and 504.00s - 507.36s | then note your favorite sci-fi movie. If you read the description, obviously I'm talking 507.36s - 511.28s | about sort of leaning into sci-fi here. So I'm going to break for 30 seconds and you, 511.28s - 581.83s | you can meet the people around you. Okay. Well, that's a minute. I hope everyone found 581.83s - 587.91s | that valuable. Okay. We can pause the talking now. We're going to, we're going to kill the, 587.91s - 592.47s | the audio for the, for the recording. Okay, great. Well, I've ticked that box for, for 592.47s - 596.39s | the policy people. So I hope you found that useful as well. Um, that is the benefit of 596.39s - 603.65s | being here, right? Um, I, I don't, I don't think I'll try audience engagement. I was 603.65s - 608.85s | going to say, can someone yell out their favorite sci-fi movie that might work? Terminator. 608.85s - 621.16s | Yes. Classic use of AI. Anything else? Star Wars. Yes. Blade Runner. Fantastic. Well, 621.16s - 626.52s | all of them involve AI, right? Which is, uh, uh, I guess funny, but sort of the point of 626.52s - 631.68s | why I wanted to involve sci-fi in the talk. Um, also because then it's easy to talk about 631.68s - 637.56s | stuff without necessarily saying that, um, you know, it comes from experience. I should make 637.56s


chunk_text:
can meet the people around you. Okay. Well, that's a minute. I hope everyone found 581.83s - 587.91s | that valuable. Okay. We can pause the talking now. We're going to, we're going to kill the, 587.91s - 592.47s | the audio for the, for the recording. Okay, great. Well, I've ticked that box for, for 592.47s - 596.39s | the policy people. So I hope you found that useful as well. Um, that is the benefit of 596.39s - 603.65s | being here, right? Um, I, I don't, I don't think I'll try audience engagement. I was 603.65s - 608.85s | going to say, can someone yell out their favorite sci-fi movie that might work? Terminator. 608.85s - 621.16s | Yes. Classic use of AI. Anything else? Star Wars. Yes. Blade Runner. Fantastic. Well, 621.16s - 626.52s | all of them involve AI, right? Which is, uh, uh, I guess funny, but sort of the point of 626.52s - 631.68s | why I wanted to involve sci-fi in the talk. Um, also because then it's easy to talk about 631.68s - 637.56s | stuff without necessarily saying that, um, you know, it comes from experience. I should make 637.56s - 642.20s | the disclaimer, actually, all of this is my own opinion and nothing from ASD. Um, I forgot to 642.20s - 647.24s | mention that earlier. Um, but that is the benefit of leaning into the science fiction narrative as 647.24s - 652.24s | well, because all of those movies that you've referred to do involve artificial intelligence 652.36s - 659.24s | and see the way that it's depicted in movies really does. I'm sure that will come back. It 659.24s - 663.40s | really does impact how people think about it and the kinds of narratives that people have about it. 663.40s - 668.88s | Um, as well as sort of in the world of intelligence, right? All of the things we think about when it 668.88s - 672.60s | comes to national security and intelligence, all of, a lot of the time, unless you've worked in 672.60s - 676.52s | those kinds of fields or with people in those fields come from movies, it's, it's really 676.64s - 682.64s | impactful. Um, and there have been quite a lot of studies that show that the, the way that 682.64s - 689.04s | technology is constructed in


chunk_text:
- 642.20s | the disclaimer, actually, all of this is my own opinion and nothing from ASD. Um, I forgot to 642.20s - 647.24s | mention that earlier. Um, but that is the benefit of leaning into the science fiction narrative as 647.24s - 652.24s | well, because all of those movies that you've referred to do involve artificial intelligence 652.36s - 659.24s | and see the way that it's depicted in movies really does. I'm sure that will come back. It 659.24s - 663.40s | really does impact how people think about it and the kinds of narratives that people have about it. 663.40s - 668.88s | Um, as well as sort of in the world of intelligence, right? All of the things we think about when it 668.88s - 672.60s | comes to national security and intelligence, all of, a lot of the time, unless you've worked in 672.60s - 676.52s | those kinds of fields or with people in those fields come from movies, it's, it's really 676.64s - 682.64s | impactful. Um, and there have been quite a lot of studies that show that the, the way that 682.64s - 689.04s | technology is constructed in movies is how it progresses. Not necessarily, but the, the 689.04s - 695.12s | creativity that's shown in, um, in narratives like this ends up, you know, informing people 695.12s - 699.72s | who then go and design them themselves. We've seen that in sort of biotech. So this is 699.72s - 703.32s | important when it comes to AI, cause we need to think about it. But these are some of my 703.36s - 708.24s | favorite science fiction. Oh, those were some of my favorite science fiction movies. I think 708.24s - 714.68s | it'll come back. Um, there we go. Um, they all also involve AI. Um, if you've read the 714.68s - 717.68s | description, which I can't really remember what I put in it actually, but I think I 717.68s - 723.72s | referenced, um, Ghost in the Shell, Neuromancer, um, Mission Impossible, not really a sci-fi 723.72s - 728.80s | movie, but it's a, an action movie that I do quite enjoy. Um, especially the last one 728.80s - 732.84s | because it involved some examples of hacking AI, which I really like and is the kind of 732.84s - 737.08s | thing that


chunk_text:
movies is how it progresses. Not necessarily, but the, the 689.04s - 695.12s | creativity that's shown in, um, in narratives like this ends up, you know, informing people 695.12s - 699.72s | who then go and design them themselves. We've seen that in sort of biotech. So this is 699.72s - 703.32s | important when it comes to AI, cause we need to think about it. But these are some of my 703.36s - 708.24s | favorite science fiction. Oh, those were some of my favorite science fiction movies. I think 708.24s - 714.68s | it'll come back. Um, there we go. Um, they all also involve AI. Um, if you've read the 714.68s - 717.68s | description, which I can't really remember what I put in it actually, but I think I 717.68s - 723.72s | referenced, um, Ghost in the Shell, Neuromancer, um, Mission Impossible, not really a sci-fi 723.72s - 728.80s | movie, but it's a, an action movie that I do quite enjoy. Um, especially the last one 728.80s - 732.84s | because it involved some examples of hacking AI, which I really like and is the kind of 732.84s - 737.08s | thing that I do and had not seen in movies very much before. I also put Doctor Who up 737.08s - 741.32s | there because I'm not talking about it today, but it is my favorite science fiction show 741.32s - 745.68s | slash content. My, um, I don't know if you can tell that I was a nerd because I studied 745.68s - 754.64s | physics, but my sweet 16th birthday party was a Doctor Who themed party. And it's even 754.64s - 758.08s | amazing that I had friends to come to this at the time, but they all came dressed up as 758.08s - 763.56s | different Doctor Who characters. Um, and I was Rose of course, and I made my own custom 763.56s - 768.60s | Doctor Who Cluedo game. Um, I created all the different cards and characters myself 768.60s - 773.60s | and then stuck them on top of my original Cluedo. So I guess we're all impacted by science 773.60s - 778.76s | fiction in some way. And now you are too because of that really terrible story. But I'm going 778.76s - 784.12s | to be sort of discussing some of the implications of


chunk_text:
I do and had not seen in movies very much before. I also put Doctor Who up 737.08s - 741.32s | there because I'm not talking about it today, but it is my favorite science fiction show 741.32s - 745.68s | slash content. My, um, I don't know if you can tell that I was a nerd because I studied 745.68s - 754.64s | physics, but my sweet 16th birthday party was a Doctor Who themed party. And it's even 754.64s - 758.08s | amazing that I had friends to come to this at the time, but they all came dressed up as 758.08s - 763.56s | different Doctor Who characters. Um, and I was Rose of course, and I made my own custom 763.56s - 768.60s | Doctor Who Cluedo game. Um, I created all the different cards and characters myself 768.60s - 773.60s | and then stuck them on top of my original Cluedo. So I guess we're all impacted by science 773.60s - 778.76s | fiction in some way. And now you are too because of that really terrible story. But I'm going 778.76s - 784.12s | to be sort of discussing some of the implications of the technologies that we see in these movies. 784.16s - 788.64s | Of course there is an important question we have to ask, and what is AI at all? Have any 788.64s - 794.60s | of you in here been to the other talks I gave this week? Okay, because I've, there's a really 794.60s - 797.92s | bad joke that I have about what AI is and I don't know whether to give it again because 797.92s - 806.16s | I've given it three times already this week and it's really bad. Okay, so when I first 806.16s - 814.38s | told my mum I work in AI, she said, oh darling, why do you work in artificial insemination? 814.42s - 819.22s | Which is really like, it's not a good joke. Um, but it's because she works in medicine 819.22s - 824.50s | and that's what AI meant to her. And she wasn't even saying that to be funny. That, that's 824.50s - 829.78s | literally the first thing that came to her mind. Um, and so even when I say AI to all 829.78s - 834.26s | of you, you think artificial intelligence, what that means to


chunk_text:
the technologies that we see in these movies. 784.16s - 788.64s | Of course there is an important question we have to ask, and what is AI at all? Have any 788.64s - 794.60s | of you in here been to the other talks I gave this week? Okay, because I've, there's a really 794.60s - 797.92s | bad joke that I have about what AI is and I don't know whether to give it again because 797.92s - 806.16s | I've given it three times already this week and it's really bad. Okay, so when I first 806.16s - 814.38s | told my mum I work in AI, she said, oh darling, why do you work in artificial insemination? 814.42s - 819.22s | Which is really like, it's not a good joke. Um, but it's because she works in medicine 819.22s - 824.50s | and that's what AI meant to her. And she wasn't even saying that to be funny. That, that's 824.50s - 829.78s | literally the first thing that came to her mind. Um, and so even when I say AI to all 829.78s - 834.26s | of you, you think artificial intelligence, what that means to different people is really 834.26s - 838.94s | different. So some people would think something like the Terminator or Skynet. Um, other people 838.94s - 844.06s | would think like just a decision making algorithm. Um, I have friends who aren't really tech 844.06s - 848.30s | people and I was talking to them about AI and they said, oh yeah, I saw this really 848.30s - 853.02s | fancy like 3D billboard in the street. That's an example of AI, right? So I think we also 853.02s - 856.62s | take it for granted that, you know, maybe we're a bit more technically literate than 856.62s - 862.10s | most people out there. Um, including people who work in sort of, um, you know, policy 862.10s - 868.62s | and a lot of, a lot of government jobs, uh, which is not, you know, not a, not to discredit 868.62s - 873.02s | their work or anything. It's just that it's such a new and emerging technology and we 873.02s - 877.14s | need to have a bit of empathy for the people who really aren't there. But I guess when 877.14s - 884.06s | I talk about AI,


chunk_text:
different people is really 834.26s - 838.94s | different. So some people would think something like the Terminator or Skynet. Um, other people 838.94s - 844.06s | would think like just a decision making algorithm. Um, I have friends who aren't really tech 844.06s - 848.30s | people and I was talking to them about AI and they said, oh yeah, I saw this really 848.30s - 853.02s | fancy like 3D billboard in the street. That's an example of AI, right? So I think we also 853.02s - 856.62s | take it for granted that, you know, maybe we're a bit more technically literate than 856.62s - 862.10s | most people out there. Um, including people who work in sort of, um, you know, policy 862.10s - 868.62s | and a lot of, a lot of government jobs, uh, which is not, you know, not a, not to discredit 868.62s - 873.02s | their work or anything. It's just that it's such a new and emerging technology and we 873.02s - 877.14s | need to have a bit of empathy for the people who really aren't there. But I guess when 877.14s - 884.06s | I talk about AI, when we think about it, artificial intelligence really refers to a goal and the 884.06s - 888.14s | term artificial intelligence has been around since the 1950s when John McCarthy coined 888.14s - 894.02s | the term for the Dartmouth conference in 1956 and he was a cybernetics researcher. And so 894.02s - 897.86s | like he was trying to get grant funding for his cybernetics research, which is basically 897.90s - 903.10s | the ability to just like create models. Um, and at the time in the 1950s that was pretty 903.10s - 909.62s | simplistic, but over the years, whatever we've referred to as AI has just referred to the 909.62s - 914.18s | cutting edge, right? So I guess these days you, you would consider AI something like 914.18s - 919.66s | LLMs and chat GPT, but in 10 years time, what we consider AI will, will change as well. 919.66s - 926.38s | So the goalposts are always moving. The other thing about definitions in AI is also that 926.38s - 931.86s | when I say AI security, so like when I say I run an AI security company, what that means 931.86s - 938.14s |


chunk_text:
when we think about it, artificial intelligence really refers to a goal and the 884.06s - 888.14s | term artificial intelligence has been around since the 1950s when John McCarthy coined 888.14s - 894.02s | the term for the Dartmouth conference in 1956 and he was a cybernetics researcher. And so 894.02s - 897.86s | like he was trying to get grant funding for his cybernetics research, which is basically 897.90s - 903.10s | the ability to just like create models. Um, and at the time in the 1950s that was pretty 903.10s - 909.62s | simplistic, but over the years, whatever we've referred to as AI has just referred to the 909.62s - 914.18s | cutting edge, right? So I guess these days you, you would consider AI something like 914.18s - 919.66s | LLMs and chat GPT, but in 10 years time, what we consider AI will, will change as well. 919.66s - 926.38s | So the goalposts are always moving. The other thing about definitions in AI is also that 926.38s - 931.86s | when I say AI security, so like when I say I run an AI security company, what that means 931.86s - 938.14s | is also very different. Most people assume AI security means AI for cybersecurity. Um, 938.14s - 941.90s | whereas for me and other people who sort of work in the field, what I really mean is the 941.90s - 947.26s | security of AI systems themselves. And they're very different, like they're inherently different. 947.26s - 953.26s | It's either using AI to do something, um, like cybersecurity applications versus like 953.34s - 958.46s | implementing or adopting security methodologies into the world of AI, which are like very 958.46s - 962.38s | different to how you would implement it in a cybersecurity setting. And then another 962.38s - 967.82s | term is AI safety, which some people would consider to be kind of the same as AI security. 967.82s - 973.34s | And I would consider quite different. Um, and why that is, I will sort of get to in a moment 973.34s - 979.82s | as well. But when we think of all the different AI uses in like security, we can sort of group 979.82s - 984.94s | them into offensive and defensive security. So in terms of the different job roles, 984.94s - 990.06s | uh,


chunk_text:
is also very different. Most people assume AI security means AI for cybersecurity. Um, 938.14s - 941.90s | whereas for me and other people who sort of work in the field, what I really mean is the 941.90s - 947.26s | security of AI systems themselves. And they're very different, like they're inherently different. 947.26s - 953.26s | It's either using AI to do something, um, like cybersecurity applications versus like 953.34s - 958.46s | implementing or adopting security methodologies into the world of AI, which are like very 958.46s - 962.38s | different to how you would implement it in a cybersecurity setting. And then another 962.38s - 967.82s | term is AI safety, which some people would consider to be kind of the same as AI security. 967.82s - 973.34s | And I would consider quite different. Um, and why that is, I will sort of get to in a moment 973.34s - 979.82s | as well. But when we think of all the different AI uses in like security, we can sort of group 979.82s - 984.94s | them into offensive and defensive security. So in terms of the different job roles, 984.94s - 990.06s | uh, we have things like ethical hackers, red teamers, exploit developers, malware analysts, 990.06s - 995.18s | vulnerability researchers, social engineers, um, just to name a few. These are all the kinds of 995.18s - 1001.90s | roles that are now being, um, you know, supplanted or augmented by AI technologies. 1003.26s - 1006.94s | When we think of defensive security, we have things like security analysts, 1006.94s - 1010.94s | network security engineers, security architects, incident responses, 1010.94s - 1016.94s | sock analysts, and threat hunters. Um, again, just to name a subset. And there is so much work 1016.94s - 1024.38s | and investment going on in this space at the moment. Um, again, looking at AI CC in the, 1024.38s - 1029.50s | in the hall below, which is insane and massive and so much funding. And I just can't imagine 1029.50s - 1034.94s | that happening in Australia. Um, again, not to bash Australia, but just like, this is such an 1034.94s - 1041.02s | incredible investment from the government in that. So that's really cool. And the challenge 1041.02s - 1048.14s | about applying AI in these kinds of settings in any, in any organization, national


chunk_text:
we have things like ethical hackers, red teamers, exploit developers, malware analysts, 990.06s - 995.18s | vulnerability researchers, social engineers, um, just to name a few. These are all the kinds of 995.18s - 1001.90s | roles that are now being, um, you know, supplanted or augmented by AI technologies. 1003.26s - 1006.94s | When we think of defensive security, we have things like security analysts, 1006.94s - 1010.94s | network security engineers, security architects, incident responses, 1010.94s - 1016.94s | sock analysts, and threat hunters. Um, again, just to name a subset. And there is so much work 1016.94s - 1024.38s | and investment going on in this space at the moment. Um, again, looking at AI CC in the, 1024.38s - 1029.50s | in the hall below, which is insane and massive and so much funding. And I just can't imagine 1029.50s - 1034.94s | that happening in Australia. Um, again, not to bash Australia, but just like, this is such an 1034.94s - 1041.02s | incredible investment from the government in that. So that's really cool. And the challenge 1041.02s - 1048.14s | about applying AI in these kinds of settings in any, in any organization, national security or not 1048.70s - 1054.78s | is that like actually building the model itself is pretty, pretty simple, but making it work, 1054.78s - 1060.94s | making it work as part of a system is really hard. Um, I do sort of have a demo. Um, I guess 1060.94s - 1068.22s | it's worth showing, but I think that the point of the demo is really just to show how simple it is 1068.22s - 1076.86s | to build like a model that, that does this kind of thing. So as part of our work, we're often 1076.86s - 1083.50s | thinking about like the intersection of AI and security, we do demos, labs, all that kind of 1083.50s - 1089.10s | stuff. Um, we, we were originally like trying to apply for AXCC, but like we're a small company, 1089.10s - 1095.42s | we couldn't quite get it together enough to do it in time. Um, but as a, as a demo, we decided to 1095.42s - 1101.66s | build a model that could classify vulnerabilities in code. Um, I know a lot of you might not be 1101.66s - 1107.10s | code people. The point of this


chunk_text:
security or not 1048.70s - 1054.78s | is that like actually building the model itself is pretty, pretty simple, but making it work, 1054.78s - 1060.94s | making it work as part of a system is really hard. Um, I do sort of have a demo. Um, I guess 1060.94s - 1068.22s | it's worth showing, but I think that the point of the demo is really just to show how simple it is 1068.22s - 1076.86s | to build like a model that, that does this kind of thing. So as part of our work, we're often 1076.86s - 1083.50s | thinking about like the intersection of AI and security, we do demos, labs, all that kind of 1083.50s - 1089.10s | stuff. Um, we, we were originally like trying to apply for AXCC, but like we're a small company, 1089.10s - 1095.42s | we couldn't quite get it together enough to do it in time. Um, but as a, as a demo, we decided to 1095.42s - 1101.66s | build a model that could classify vulnerabilities in code. Um, I know a lot of you might not be 1101.66s - 1107.10s | code people. The point of this is just to show that in the, like this is a two time speed, but 1107.10s - 1115.02s | in the three minutes that this notebook takes to run, we were able to, um, down, we were able to 1115.02s - 1123.50s | download a bunch of code, secure and insecure code, um, build a model that was able to classify 1123.50s - 1130.38s | which of this code was secure or insecure. Um, run that a few times, you can sort of see this 1130.38s - 1136.94s | training process here. And then when it was presented new code, it could correctly classify 1136.94s - 1143.42s | whether it was vulnerable or not. Um, and that's the whole point of the AI XCC challenge, but 1143.42s - 1149.10s | actually applying this at scale is really, really hard. And so some of the troubles that we see in 1149.10s - 1154.70s | applying AI in all of these settings is this whole idea of like moving beyond the pilot stage, 1154.70s - 1158.38s | like actually getting these sorts of models to speak together is really difficult and it's not 1158.38s - 1164.78s | trivial. And it's something that


chunk_text:
is just to show that in the, like this is a two time speed, but 1107.10s - 1115.02s | in the three minutes that this notebook takes to run, we were able to, um, down, we were able to 1115.02s - 1123.50s | download a bunch of code, secure and insecure code, um, build a model that was able to classify 1123.50s - 1130.38s | which of this code was secure or insecure. Um, run that a few times, you can sort of see this 1130.38s - 1136.94s | training process here. And then when it was presented new code, it could correctly classify 1136.94s - 1143.42s | whether it was vulnerable or not. Um, and that's the whole point of the AI XCC challenge, but 1143.42s - 1149.10s | actually applying this at scale is really, really hard. And so some of the troubles that we see in 1149.10s - 1154.70s | applying AI in all of these settings is this whole idea of like moving beyond the pilot stage, 1154.70s - 1158.38s | like actually getting these sorts of models to speak together is really difficult and it's not 1158.38s - 1164.78s | trivial. And it's something that we're all grappling with. Um, and the reason that it's 1164.78s - 1170.38s | important from a sort of policy perspective, I guess, is because like the kinds of organizations 1170.38s - 1177.82s | who are working on this stuff, um, you know, the big tech giants, um, as in like who have that sort 1177.82s - 1183.02s | of that AI capability and have the compute to be able to do this. Um, this is a really novel 1183.02s - 1187.50s | challenge, right? Like in the past we've seen governments have quite a lot of power when it 1187.50s - 1192.86s | comes to the technologies that are challenging. So you've probably heard of like the crypto wars 1192.86s - 1199.10s | in the nineties and the noughties and like the, the challenge that different governments and 1199.10s - 1204.78s | national security organizations were having around people using end-to-end encryption and 1204.78s - 1210.78s | their inability to sort of get through that and how they can now, um, you know, mandate different 1210.78s - 1216.30s | bodies to be able to either like bypass that, or they were trying to do things like, um, mandate 1216.30s


chunk_text:
we're all grappling with. Um, and the reason that it's 1164.78s - 1170.38s | important from a sort of policy perspective, I guess, is because like the kinds of organizations 1170.38s - 1177.82s | who are working on this stuff, um, you know, the big tech giants, um, as in like who have that sort 1177.82s - 1183.02s | of that AI capability and have the compute to be able to do this. Um, this is a really novel 1183.02s - 1187.50s | challenge, right? Like in the past we've seen governments have quite a lot of power when it 1187.50s - 1192.86s | comes to the technologies that are challenging. So you've probably heard of like the crypto wars 1192.86s - 1199.10s | in the nineties and the noughties and like the, the challenge that different governments and 1199.10s - 1204.78s | national security organizations were having around people using end-to-end encryption and 1204.78s - 1210.78s | their inability to sort of get through that and how they can now, um, you know, mandate different 1210.78s - 1216.30s | bodies to be able to either like bypass that, or they were trying to do things like, um, mandate 1216.30s - 1221.42s | implants into different technologies. In Australia in particular, there was some recent controversial 1221.42s - 1227.18s | legislation that would also sort of mandate companies to, or at least provide the ability 1227.26s - 1235.02s | to mandate companies to open those, those back doors as well. But being able to like do that in 1235.02s - 1239.50s | an AI setting, when we're talking about like applying these models to really difficult use 1239.50s - 1245.42s | cases, um, is, is a real challenge that we're seeing in the policy space at the moment. Like 1245.42s - 1251.66s | how do we actually do that? How do governments cooperate with, like with these different 1251.66s - 1257.34s | companies? And that's something that we're trying to figure out now. Um, so if you consider that a 1257.34s - 1265.42s | bit of a summary of how AI for security in an offensive and defensive, um, like fashion is used, 1265.42s - 1269.66s | um, of course I feel like I have to touch on hacking with AI. There have been some really 1269.66s - 1276.86s | high profile cases of, um, APT groups, so Advanced Persistent


chunk_text:
- 1221.42s | implants into different technologies. In Australia in particular, there was some recent controversial 1221.42s - 1227.18s | legislation that would also sort of mandate companies to, or at least provide the ability 1227.26s - 1235.02s | to mandate companies to open those, those back doors as well. But being able to like do that in 1235.02s - 1239.50s | an AI setting, when we're talking about like applying these models to really difficult use 1239.50s - 1245.42s | cases, um, is, is a real challenge that we're seeing in the policy space at the moment. Like 1245.42s - 1251.66s | how do we actually do that? How do governments cooperate with, like with these different 1251.66s - 1257.34s | companies? And that's something that we're trying to figure out now. Um, so if you consider that a 1257.34s - 1265.42s | bit of a summary of how AI for security in an offensive and defensive, um, like fashion is used, 1265.42s - 1269.66s | um, of course I feel like I have to touch on hacking with AI. There have been some really 1269.66s - 1276.86s | high profile cases of, um, APT groups, so Advanced Persistent Threats, um, trying to use, 1277.58s - 1283.90s | um, you know, AI created by big companies like OpenAI and Anthropic to do hacking for them and to 1283.90s - 1290.62s | augment this. Um, is this a real threat? I mean, yes and no. I think the way to think about 1290.62s - 1295.26s | artificial intelligence is that it augments existing efforts, right? So we've seen quite 1295.26s - 1302.30s | a lot of hype around how this can be, um, I guess a revolutionary challenge, um, and how it's a, 1303.26s - 1309.26s | a really big deal and maybe that's not really the right way of thinking about it but, but thinking 1309.26s - 1315.26s | about it as more of a tool because we're still sort of waiting to see, like, the kind of 1315.26s - 1322.86s | impacts that people are promising we might see. Um, there are two examples of, like, APT groups 1322.86s - 1328.06s | that have been using AI that I can sort of think of off the top of my head. Um, Russia and Iran, 1328.06s - 1333.98s | for example, have been doing it to create deepfakes, um,


chunk_text:
Threats, um, trying to use, 1277.58s - 1283.90s | um, you know, AI created by big companies like OpenAI and Anthropic to do hacking for them and to 1283.90s - 1290.62s | augment this. Um, is this a real threat? I mean, yes and no. I think the way to think about 1290.62s - 1295.26s | artificial intelligence is that it augments existing efforts, right? So we've seen quite 1295.26s - 1302.30s | a lot of hype around how this can be, um, I guess a revolutionary challenge, um, and how it's a, 1303.26s - 1309.26s | a really big deal and maybe that's not really the right way of thinking about it but, but thinking 1309.26s - 1315.26s | about it as more of a tool because we're still sort of waiting to see, like, the kind of 1315.26s - 1322.86s | impacts that people are promising we might see. Um, there are two examples of, like, APT groups 1322.86s - 1328.06s | that have been using AI that I can sort of think of off the top of my head. Um, Russia and Iran, 1328.06s - 1333.98s | for example, have been doing it to create deepfakes, um, to sort of augment existing, 1334.78s - 1342.22s | um, you know, ways to make money for them, um, I guess as a way of sort of putting it bluntly. 1342.22s - 1347.18s | Um, but I think the right way to think about it, again, is that it's part of the kill chain. It's 1347.18s - 1355.10s | not necessarily a new, a new technology, um, or a new threat but it's really how it augments the 1355.10s - 1364.65s | existing kill chain and amplifies those sorts of efforts. I hope the, I can't tell how often 1364.65s - 1369.61s | the screen is doing that so I hope it's not too annoying. Um, we've seen examples of this from 1369.61s - 1375.37s | all of the different APT groups, um, to different extents, um, and this is just a selection of them 1375.37s - 1383.53s | as well. But I, I feel like quite a lot of talks do focus on things like AI for hacking and I, 1383.53s - 1388.17s | I don't want to go down that rabbit hole because that's not really the thing that I'm interested 1388.17s - 1394.65s | in. The thing


chunk_text:
to sort of augment existing, 1334.78s - 1342.22s | um, you know, ways to make money for them, um, I guess as a way of sort of putting it bluntly. 1342.22s - 1347.18s | Um, but I think the right way to think about it, again, is that it's part of the kill chain. It's 1347.18s - 1355.10s | not necessarily a new, a new technology, um, or a new threat but it's really how it augments the 1355.10s - 1364.65s | existing kill chain and amplifies those sorts of efforts. I hope the, I can't tell how often 1364.65s - 1369.61s | the screen is doing that so I hope it's not too annoying. Um, we've seen examples of this from 1369.61s - 1375.37s | all of the different APT groups, um, to different extents, um, and this is just a selection of them 1375.37s - 1383.53s | as well. But I, I feel like quite a lot of talks do focus on things like AI for hacking and I, 1383.53s - 1388.17s | I don't want to go down that rabbit hole because that's not really the thing that I'm interested 1388.17s - 1394.65s | in. The thing I'm interested in is more of the, the strategic so what, um, which again might not 1394.65s - 1399.37s | be all that interesting for some people but the thing I care about is like how do we actually 1399.37s - 1404.33s | approach all those different issues of, you know, AI for security and security of AI because 1404.33s - 1409.61s | especially working in an AI security field, I see there is so much talk about AI for security, 1409.61s - 1412.81s | there's a lot of investment, there's a lot of smart people thinking about it, I don't think 1412.81s - 1417.45s | that's really the problem, problem at the moment. I think the problem right now is that not many 1417.45s - 1421.61s | people or not enough people are talking about the security of the AI systems themselves. 1422.89s - 1429.77s | So let's think about how we hack an AI system at all. So I guess you could say that the idea 1429.77s - 1435.29s | of hacking an AI has been around as long as AI systems have themselves, you know, especially 1435.29s - 1440.89s | whatever we define as AI, right? So


chunk_text:
I'm interested in is more of the, the strategic so what, um, which again might not 1394.65s - 1399.37s | be all that interesting for some people but the thing I care about is like how do we actually 1399.37s - 1404.33s | approach all those different issues of, you know, AI for security and security of AI because 1404.33s - 1409.61s | especially working in an AI security field, I see there is so much talk about AI for security, 1409.61s - 1412.81s | there's a lot of investment, there's a lot of smart people thinking about it, I don't think 1412.81s - 1417.45s | that's really the problem, problem at the moment. I think the problem right now is that not many 1417.45s - 1421.61s | people or not enough people are talking about the security of the AI systems themselves. 1422.89s - 1429.77s | So let's think about how we hack an AI system at all. So I guess you could say that the idea 1429.77s - 1435.29s | of hacking an AI has been around as long as AI systems have themselves, you know, especially 1435.29s - 1440.89s | whatever we define as AI, right? So the first example that comes to mind is a simple algorithm 1440.89s - 1445.69s | like an email spam filter. As long as those have been around, people have been trying to evade 1445.69s - 1452.49s | spam filters and you could think of that as an example of hacking an AI system. When we think 1452.49s - 1457.93s | about the modern or the the most recent implementation of AI hacking, it's the field 1457.93s - 1462.81s | of adversarial machine learning which is sort of my field and the topic of my PhD and my other research 1463.53s - 1467.93s | but it's basically ways that you can exploit the inherent characteristics of machine learning 1467.93s - 1472.57s | models and machine learning models are the underpinning of most or all AI systems at the 1472.57s - 1479.29s | moment and so in the real world we're starting to see these kinds of attacks possibly come to 1479.29s - 1485.05s | fruition. It's always been considered a very academic discipline. This is sort of the classic 1485.05s - 1489.37s | adversarial machine learning example. Can I get a show of hands if anyone's like seen this before 1489.37s


chunk_text:
the first example that comes to mind is a simple algorithm 1440.89s - 1445.69s | like an email spam filter. As long as those have been around, people have been trying to evade 1445.69s - 1452.49s | spam filters and you could think of that as an example of hacking an AI system. When we think 1452.49s - 1457.93s | about the modern or the the most recent implementation of AI hacking, it's the field 1457.93s - 1462.81s | of adversarial machine learning which is sort of my field and the topic of my PhD and my other research 1463.53s - 1467.93s | but it's basically ways that you can exploit the inherent characteristics of machine learning 1467.93s - 1472.57s | models and machine learning models are the underpinning of most or all AI systems at the 1472.57s - 1479.29s | moment and so in the real world we're starting to see these kinds of attacks possibly come to 1479.29s - 1485.05s | fruition. It's always been considered a very academic discipline. This is sort of the classic 1485.05s - 1489.37s | adversarial machine learning example. Can I get a show of hands if anyone's like seen this before 1489.37s - 1496.25s | or familiar with adversarial machine learning? Okay, so it's definitely entering more of the 1496.25s - 1501.21s | discourse at the moment but the idea at its heart, and this is from a paper about 10 years 1501.21s - 1506.81s | ago now, so it's it's new but it's not that new. The idea was that you could take a clean image, 1506.81s - 1513.45s | so of this panda, and you could create special noise that when superimposed on top of that image 1513.45s - 1518.73s | prevents a model from recognizing it and the idea is that this this noise or these adversarial 1518.73s - 1524.65s | perturbations, this adversarial example, is crafted specifically with the target model in mind and 1524.65s - 1531.37s | that you're able to constrain it within a small epsilon value so that a human can't recognize it. 1531.37s - 1535.45s | It's just enough that it passes a sort of classification boundary according to the model 1535.45s - 1540.81s | but not so much that it's recognized and this is sort of the, I guess, the proverbial example that 1540.81s - 1545.53s | most people show when they talk


chunk_text:
- 1496.25s | or familiar with adversarial machine learning? Okay, so it's definitely entering more of the 1496.25s - 1501.21s | discourse at the moment but the idea at its heart, and this is from a paper about 10 years 1501.21s - 1506.81s | ago now, so it's it's new but it's not that new. The idea was that you could take a clean image, 1506.81s - 1513.45s | so of this panda, and you could create special noise that when superimposed on top of that image 1513.45s - 1518.73s | prevents a model from recognizing it and the idea is that this this noise or these adversarial 1518.73s - 1524.65s | perturbations, this adversarial example, is crafted specifically with the target model in mind and 1524.65s - 1531.37s | that you're able to constrain it within a small epsilon value so that a human can't recognize it. 1531.37s - 1535.45s | It's just enough that it passes a sort of classification boundary according to the model 1535.45s - 1540.81s | but not so much that it's recognized and this is sort of the, I guess, the proverbial example that 1540.81s - 1545.53s | most people show when they talk about adversarial machine learning and it's always been considered 1545.53s - 1550.33s | a bit of an academic threat. Like it wasn't necessarily taken seriously. When I told my 1550.33s - 1554.89s | PhD supervisors this is what I wanted to work on, they were like, I don't know if this will ever 1554.89s - 1558.89s | become a thing, you know, it might not, you know, you might be shooting yourself in the foot, this AI 1558.89s - 1566.73s | security thing. Um times have changed. It was also Australia. Again, love Australia but it's I'm not 1566.73s - 1574.25s | trying to, yeah, it's it's it's always um yeah it's a smaller market. Um so now we're starting to see 1574.89s - 1580.81s | more examples in the wild as you'd call it. So things like being able to paint special paint 1580.81s - 1586.01s | onto a stop sign so that like an autonomous vehicle doesn't recognize it and would drive 1586.01s - 1591.77s | straight through. And this is just in computer vision, right? So computer vision is a kind of 1591.77s - 1596.01s | machine learning where you're looking at the world around you and


chunk_text:
about adversarial machine learning and it's always been considered 1545.53s - 1550.33s | a bit of an academic threat. Like it wasn't necessarily taken seriously. When I told my 1550.33s - 1554.89s | PhD supervisors this is what I wanted to work on, they were like, I don't know if this will ever 1554.89s - 1558.89s | become a thing, you know, it might not, you know, you might be shooting yourself in the foot, this AI 1558.89s - 1566.73s | security thing. Um times have changed. It was also Australia. Again, love Australia but it's I'm not 1566.73s - 1574.25s | trying to, yeah, it's it's it's always um yeah it's a smaller market. Um so now we're starting to see 1574.89s - 1580.81s | more examples in the wild as you'd call it. So things like being able to paint special paint 1580.81s - 1586.01s | onto a stop sign so that like an autonomous vehicle doesn't recognize it and would drive 1586.01s - 1591.77s | straight through. And this is just in computer vision, right? So computer vision is a kind of 1591.77s - 1596.01s | machine learning where you're looking at the world around you and identifying what it is. 1596.65s - 1600.49s | Um but when we think about all of the different use cases of AI, there's things like natural 1600.49s - 1606.57s | language processing and LLMs, um signal classification, RF, radio frequency, audio 1606.57s - 1610.65s | waves, those are all use cases for machine learning where all of these kinds of attacks 1610.65s - 1616.73s | apply as well but they're harder to see, like they're even harder to see. And if we think about 1616.73s - 1622.01s | machine learning systems as well you know you'd call them an attack surface, right? As you'd use 1622.01s - 1626.89s | the the cyber sort of lexicon. You can think about all of these different attack surfaces that have 1626.89s - 1631.45s | their own unique characteristics. All the different kinds of models that do different things. 1631.45s - 1636.01s | So at the top we have a convolutional neural network which is a kind of machine learning 1636.01s - 1640.73s | model that's really good for computer vision because it decomposes information down really 1640.73s - 1645.77s | easily. Um and then on the bottom we have a transformer which is


chunk_text:
identifying what it is. 1596.65s - 1600.49s | Um but when we think about all of the different use cases of AI, there's things like natural 1600.49s - 1606.57s | language processing and LLMs, um signal classification, RF, radio frequency, audio 1606.57s - 1610.65s | waves, those are all use cases for machine learning where all of these kinds of attacks 1610.65s - 1616.73s | apply as well but they're harder to see, like they're even harder to see. And if we think about 1616.73s - 1622.01s | machine learning systems as well you know you'd call them an attack surface, right? As you'd use 1622.01s - 1626.89s | the the cyber sort of lexicon. You can think about all of these different attack surfaces that have 1626.89s - 1631.45s | their own unique characteristics. All the different kinds of models that do different things. 1631.45s - 1636.01s | So at the top we have a convolutional neural network which is a kind of machine learning 1636.01s - 1640.73s | model that's really good for computer vision because it decomposes information down really 1640.73s - 1645.77s | easily. Um and then on the bottom we have a transformer which is the backbone of of GPT 1645.77s - 1649.85s | models and is very good at natural language processing. Those are very different kinds 1649.85s - 1654.65s | of models. Like they have some commonalities in the sense that it's all about optimization and 1654.65s - 1659.45s | being able to you know predict things whether it's next words or images um but they're really 1659.45s - 1664.01s | quite different. They're different attack surfaces and especially if we're adding these two cyber 1664.01s - 1669.53s | systems they present entirely new threats. Like this is an extension of the existing cyber attack 1669.53s - 1675.85s | surface um that is not covered by existing cyber security methodology. You know for the organizations 1675.85s - 1680.97s | that are adopting AI without thinking about the security of them um they're they're opening 1680.97s - 1685.93s | themselves up to new vulnerabilities. So this is sort of the example that I gave in my other talks. 1685.93s - 1693.29s | It's being able to add different adversarial um like regions distributed regions to images so that 1693.29s - 1698.49s | you can sort of hack facial recognition. You can do this with


chunk_text:
the backbone of of GPT 1645.77s - 1649.85s | models and is very good at natural language processing. Those are very different kinds 1649.85s - 1654.65s | of models. Like they have some commonalities in the sense that it's all about optimization and 1654.65s - 1659.45s | being able to you know predict things whether it's next words or images um but they're really 1659.45s - 1664.01s | quite different. They're different attack surfaces and especially if we're adding these two cyber 1664.01s - 1669.53s | systems they present entirely new threats. Like this is an extension of the existing cyber attack 1669.53s - 1675.85s | surface um that is not covered by existing cyber security methodology. You know for the organizations 1675.85s - 1680.97s | that are adopting AI without thinking about the security of them um they're they're opening 1680.97s - 1685.93s | themselves up to new vulnerabilities. So this is sort of the example that I gave in my other talks. 1685.93s - 1693.29s | It's being able to add different adversarial um like regions distributed regions to images so that 1693.29s - 1698.49s | you can sort of hack facial recognition. You can do this with any kind of model really. Um the reason 1698.49s - 1702.97s | I was so excited to see the recent Mission Impossible movie is because this is what they did. 1702.97s - 1708.33s | I was it was really great. Um there was this scene where Ethan Hunt was running through an airport 1708.33s - 1712.97s | and people were looking at the surveillance footage and someone was able to digitally 1712.97s - 1718.33s | manipulate the surveillance footage so that he looked like somebody else. And the thing was that 1718.33s - 1721.69s | they didn't need to do it in the real world because the people were only looking at the 1721.69s - 1726.89s | surveillance footage. And it's the kind of thing where you know a lot of AML techniques or adversarial 1726.89s - 1731.45s | machine learning techniques they were considered too academic because people couldn't really see 1731.45s - 1737.05s | how it could relate to the real world. Like how do you put in a bunch of adversarial pixels in a 1737.05s - 1741.29s | real world and move it around. But you know the point is that you don't always need to especially


chunk_text:
any kind of model really. Um the reason 1698.49s - 1702.97s | I was so excited to see the recent Mission Impossible movie is because this is what they did. 1702.97s - 1708.33s | I was it was really great. Um there was this scene where Ethan Hunt was running through an airport 1708.33s - 1712.97s | and people were looking at the surveillance footage and someone was able to digitally 1712.97s - 1718.33s | manipulate the surveillance footage so that he looked like somebody else. And the thing was that 1718.33s - 1721.69s | they didn't need to do it in the real world because the people were only looking at the 1721.69s - 1726.89s | surveillance footage. And it's the kind of thing where you know a lot of AML techniques or adversarial 1726.89s - 1731.45s | machine learning techniques they were considered too academic because people couldn't really see 1731.45s - 1737.05s | how it could relate to the real world. Like how do you put in a bunch of adversarial pixels in a 1737.05s - 1741.29s | real world and move it around. But you know the point is that you don't always need to especially 1741.29s - 1746.01s | now that machine learning models are doing a lot of this kind of stuff autonomously. You know 1746.01s - 1751.13s | in the national security setting especially you know you have a lot of models that are being built 1751.13s - 1756.41s | to do things like platform detection looking for uh you know tanks and ships and boats and things. 1756.41s - 1762.01s | Um person identification um you don't always need to rely on having something in the real 1762.01s - 1765.77s | world anymore. A lot of it's digital and a lot of this kind of stuff can be injected 1765.77s - 1772.97s | just like in Mission Impossible. So this is where we get to something that I find really interesting. 1774.57s - 1781.37s | So bear with me um there's some security studies uh I guess theory that is really interesting to 1781.37s - 1788.49s | apply to AI and AI security. Um a few particular things are thinking about the referent object, 1788.49s - 1795.05s | the direction of protection and securitization. Um so what do I mean by these things? 1796.25s - 1802.57s | The referent object basically refers


chunk_text:
1741.29s - 1746.01s | now that machine learning models are doing a lot of this kind of stuff autonomously. You know 1746.01s - 1751.13s | in the national security setting especially you know you have a lot of models that are being built 1751.13s - 1756.41s | to do things like platform detection looking for uh you know tanks and ships and boats and things. 1756.41s - 1762.01s | Um person identification um you don't always need to rely on having something in the real 1762.01s - 1765.77s | world anymore. A lot of it's digital and a lot of this kind of stuff can be injected 1765.77s - 1772.97s | just like in Mission Impossible. So this is where we get to something that I find really interesting. 1774.57s - 1781.37s | So bear with me um there's some security studies uh I guess theory that is really interesting to 1781.37s - 1788.49s | apply to AI and AI security. Um a few particular things are thinking about the referent object, 1788.49s - 1795.05s | the direction of protection and securitization. Um so what do I mean by these things? 1796.25s - 1802.57s | The referent object basically refers to the thing that you're trying to protect. Um so security 1802.57s - 1809.93s | studies comes from sort of military security um and then is now being applied to like cyber 1809.93s - 1818.41s | security um more rigorously. But it it basically means uh if we're creating um policy or legislation 1818.41s - 1825.93s | or you know rules um what are we actually trying to protect? Um and usually in a in a national 1825.93s - 1830.65s | security sense that would be the state so like a nation state um and if we're thinking about 1830.65s - 1837.61s | cyber security it'd be like the cyber system, the cyber system. Um direction of protection 1837.61s - 1845.37s | is all about what is if we think about what is being protected from whom. So if we think about 1845.37s - 1853.29s | comparing AI for security versus the security of AI um this is one way of thinking about the 1853.29s - 1860.09s | direction of protection um and it's a fundamental difference. The other one is AI safety versus AI 1860.09s - 1865.93s | security. In the AI world there's actually quite a lot of


chunk_text:
to the thing that you're trying to protect. Um so security 1802.57s - 1809.93s | studies comes from sort of military security um and then is now being applied to like cyber 1809.93s - 1818.41s | security um more rigorously. But it it basically means uh if we're creating um policy or legislation 1818.41s - 1825.93s | or you know rules um what are we actually trying to protect? Um and usually in a in a national 1825.93s - 1830.65s | security sense that would be the state so like a nation state um and if we're thinking about 1830.65s - 1837.61s | cyber security it'd be like the cyber system, the cyber system. Um direction of protection 1837.61s - 1845.37s | is all about what is if we think about what is being protected from whom. So if we think about 1845.37s - 1853.29s | comparing AI for security versus the security of AI um this is one way of thinking about the 1853.29s - 1860.09s | direction of protection um and it's a fundamental difference. The other one is AI safety versus AI 1860.09s - 1865.93s | security. In the AI world there's actually quite a lot of debate about whether AI safety is different 1865.93s - 1873.05s | to AI security and what safety versus security even means and it's fascinating to me maybe not 1873.05s - 1878.57s | to everyone else but people in AI get really heated about this because people have very strong 1878.57s - 1885.21s | opinions and it's often seen as sort of a philosophical question almost whereas to me 1885.21s - 1890.81s | I I think it's pretty simple and it comes down to the direction of protection. Like to me AI safety 1890.81s - 1897.45s | is protecting the environment from the AI system whereas AI security is about protecting the system 1897.45s - 1902.09s | from the environment and that's how you'd characterize it in a military studies or a 1902.09s - 1908.25s | cyber security approach as well. Like if we think about the cyber analogy, cyber safety is protecting 1908.25s - 1915.13s | like people or users from um like cyber systems that might do them harm. So protecting them from 1915.13s - 1919.21s | online bullying, making sure there's equitable access to the internet, things like that whereas 1919.77s - 1923.85s | cyber security is about


chunk_text:
debate about whether AI safety is different 1865.93s - 1873.05s | to AI security and what safety versus security even means and it's fascinating to me maybe not 1873.05s - 1878.57s | to everyone else but people in AI get really heated about this because people have very strong 1878.57s - 1885.21s | opinions and it's often seen as sort of a philosophical question almost whereas to me 1885.21s - 1890.81s | I I think it's pretty simple and it comes down to the direction of protection. Like to me AI safety 1890.81s - 1897.45s | is protecting the environment from the AI system whereas AI security is about protecting the system 1897.45s - 1902.09s | from the environment and that's how you'd characterize it in a military studies or a 1902.09s - 1908.25s | cyber security approach as well. Like if we think about the cyber analogy, cyber safety is protecting 1908.25s - 1915.13s | like people or users from um like cyber systems that might do them harm. So protecting them from 1915.13s - 1919.21s | online bullying, making sure there's equitable access to the internet, things like that whereas 1919.77s - 1923.85s | cyber security is about protecting the cyber system from external threat actors. 1923.93s - 1933.21s | We then arrive at this concept of securitization uh and securitization basically takes the premise 1933.21s - 1938.33s | that if something is considered an existential threat then a state is able to use extraordinary 1938.33s - 1947.53s | measures to protect that thing. So a good example of this is the rise of um yeah cyber security. 1947.53s - 1956.17s | So in uh say 2008 kind of times we were starting to see um the cyber attacks on Estonia uh and 1956.17s - 1962.73s | Georgia being considered the first instances of cyber war and cyber warfare and this you know 1962.73s - 1970.17s | enabled um the government to enact lots of cyber security laws and and measures because the threat 1970.17s - 1976.33s | was suddenly considered existential when it's applied to say a nation state versus when it's 1976.33s - 1982.25s | just applied to sort of the users. And it's interesting because we've seen this evolution 1982.25s - 1987.93s | of that take place through terms like computer security versus cyber security. I mean the 1987.93s - 1994.17s | discipline of protecting


chunk_text:
protecting the cyber system from external threat actors. 1923.93s - 1933.21s | We then arrive at this concept of securitization uh and securitization basically takes the premise 1933.21s - 1938.33s | that if something is considered an existential threat then a state is able to use extraordinary 1938.33s - 1947.53s | measures to protect that thing. So a good example of this is the rise of um yeah cyber security. 1947.53s - 1956.17s | So in uh say 2008 kind of times we were starting to see um the cyber attacks on Estonia uh and 1956.17s - 1962.73s | Georgia being considered the first instances of cyber war and cyber warfare and this you know 1962.73s - 1970.17s | enabled um the government to enact lots of cyber security laws and and measures because the threat 1970.17s - 1976.33s | was suddenly considered existential when it's applied to say a nation state versus when it's 1976.33s - 1982.25s | just applied to sort of the users. And it's interesting because we've seen this evolution 1982.25s - 1987.93s | of that take place through terms like computer security versus cyber security. I mean the 1987.93s - 1994.17s | discipline of protecting cyber systems used to be called computer security um but as it's gone 1994.17s - 1999.45s | through this transition to becoming an existential threat and one which warrants additional laws and 1999.45s - 2005.85s | regulations to protect it, it's become um cyber security. And there's other you know stories that 2005.85s - 2010.81s | people have about the evolution of that as well. Um the point I'm making is that it's a transition 2010.81s - 2019.35s | that has happened alongside the securitization of of computers and cyber systems. So when we 2019.35s - 2024.63s | think about this in terms of AI policy there's a lot we can learn about how to make sure we're 2024.63s - 2032.23s | creating good AI policy based on those principles and the evolutions that we've seen from cyber. 2033.19s - 2041.91s | This is a a research paper that um my team has done recently which was um a lot of work um but 2041.91s - 2047.27s | basically it's uh it it's looking at this, it's it's understanding if AI is going through a 2047.27s - 2053.43s | securitization process. Um and so we did a review of public


chunk_text:
cyber systems used to be called computer security um but as it's gone 1994.17s - 1999.45s | through this transition to becoming an existential threat and one which warrants additional laws and 1999.45s - 2005.85s | regulations to protect it, it's become um cyber security. And there's other you know stories that 2005.85s - 2010.81s | people have about the evolution of that as well. Um the point I'm making is that it's a transition 2010.81s - 2019.35s | that has happened alongside the securitization of of computers and cyber systems. So when we 2019.35s - 2024.63s | think about this in terms of AI policy there's a lot we can learn about how to make sure we're 2024.63s - 2032.23s | creating good AI policy based on those principles and the evolutions that we've seen from cyber. 2033.19s - 2041.91s | This is a a research paper that um my team has done recently which was um a lot of work um but 2041.91s - 2047.27s | basically it's uh it it's looking at this, it's it's understanding if AI is going through a 2047.27s - 2053.43s | securitization process. Um and so we did a review of public AI policy which is why I said it was a 2054.07s - 2064.31s | lot of work. Um oecd.ai currently has a live repository of like all or at least um hopefully 2064.31s - 2073.19s | all AI policies in the world. There's 1,937 AI policies in the world um at least time of doing 2073.19s - 2077.03s | this research and based on what they have access to, based on certain requirements of things. 2077.99s - 2084.07s | Um that's a lot of policy. So we wanted to understand which of these policies um 2085.03s - 2089.35s | although those three different axes of information to what extent these policies 2089.35s - 2095.35s | focus on those. So what did the policy consider as the referent object? Um how did it consider 2095.35s - 2105.59s | the direction of security? Um and then um what was it did how did it define AI security? Like did 2105.59s - 2112.15s | it define it as AI for cyber security? Did it define it as the security of AI? Um or maybe it 2112.15s - 2118.79s | was something else. Um how did they they think about all of those things?


chunk_text:
AI policy which is why I said it was a 2054.07s - 2064.31s | lot of work. Um oecd.ai currently has a live repository of like all or at least um hopefully 2064.31s - 2073.19s | all AI policies in the world. There's 1,937 AI policies in the world um at least time of doing 2073.19s - 2077.03s | this research and based on what they have access to, based on certain requirements of things. 2077.99s - 2084.07s | Um that's a lot of policy. So we wanted to understand which of these policies um 2085.03s - 2089.35s | although those three different axes of information to what extent these policies 2089.35s - 2095.35s | focus on those. So what did the policy consider as the referent object? Um how did it consider 2095.35s - 2105.59s | the direction of security? Um and then um what was it did how did it define AI security? Like did 2105.59s - 2112.15s | it define it as AI for cyber security? Did it define it as the security of AI? Um or maybe it 2112.15s - 2118.79s | was something else. Um how did they they think about all of those things? And so we found that 2118.79s - 2125.19s | out of all of those policies an overwhelming number of them only considered AI in the context 2125.19s - 2131.51s | of using it for security and it wasn't even for cyber security right it was for national security. 2131.51s - 2135.11s | Um I mean obviously these are public policies so that does sort of make sense. 2135.83s - 2141.75s | Um but it was so overwhelming that for us this is really interesting because 2143.59s - 2149.83s | the the the lack of consideration for AI safety in particular was really surprising to me because 2149.83s - 2156.63s | there is quite a lot of narrative about AI safety at the moment. Um the lack of consideration for AI 2156.63s - 2161.75s | security for me was less surprising um based on all the conversations I have which I also think 2161.75s - 2168.31s | is a really big problem if um you know we need to be considering AI security far more. We also 2168.95s - 2173.59s | looked at who the referent object was in the policy and especially given that these policies 2173.59s - 2179.03s |


chunk_text:
And so we found that 2118.79s - 2125.19s | out of all of those policies an overwhelming number of them only considered AI in the context 2125.19s - 2131.51s | of using it for security and it wasn't even for cyber security right it was for national security. 2131.51s - 2135.11s | Um I mean obviously these are public policies so that does sort of make sense. 2135.83s - 2141.75s | Um but it was so overwhelming that for us this is really interesting because 2143.59s - 2149.83s | the the the lack of consideration for AI safety in particular was really surprising to me because 2149.83s - 2156.63s | there is quite a lot of narrative about AI safety at the moment. Um the lack of consideration for AI 2156.63s - 2161.75s | security for me was less surprising um based on all the conversations I have which I also think 2161.75s - 2168.31s | is a really big problem if um you know we need to be considering AI security far more. We also 2168.95s - 2173.59s | looked at who the referent object was in the policy and especially given that these policies 2173.59s - 2179.03s | mostly focused on AI for security of the state it makes sense that the referent object was the 2179.03s - 2184.31s | nation state. Um and this was followed by sort of a mixture of the state and the individual 2184.31s - 2189.83s | and then the individual and then the AI. Now what does like it does this even matter these 2189.83s - 2195.27s | are public policies you know is this really what they need to be addressing? This number represents 2196.31s - 2202.23s | the proportion of cyber policy that focuses on cyber security. 60 percent of cyber policy focuses 2202.23s - 2211.59s | on cyber security. Um why can't we learn these lessons and apply it to AI? Um Neuromancer is a 2211.59s - 2216.31s | really good like science fiction book. This is one of my favorite sci-fi books I think actually 2216.31s - 2223.91s | and it's often credited as the first um time that the term cyberspace was used. This is written in 2223.91s - 2228.95s | the I think seventies I believe by William William Gibson and I highly recommend it. Um and the 2228.95s - 2233.91s | premise of the book


chunk_text:
mostly focused on AI for security of the state it makes sense that the referent object was the 2179.03s - 2184.31s | nation state. Um and this was followed by sort of a mixture of the state and the individual 2184.31s - 2189.83s | and then the individual and then the AI. Now what does like it does this even matter these 2189.83s - 2195.27s | are public policies you know is this really what they need to be addressing? This number represents 2196.31s - 2202.23s | the proportion of cyber policy that focuses on cyber security. 60 percent of cyber policy focuses 2202.23s - 2211.59s | on cyber security. Um why can't we learn these lessons and apply it to AI? Um Neuromancer is a 2211.59s - 2216.31s | really good like science fiction book. This is one of my favorite sci-fi books I think actually 2216.31s - 2223.91s | and it's often credited as the first um time that the term cyberspace was used. This is written in 2223.91s - 2228.95s | the I think seventies I believe by William William Gibson and I highly recommend it. Um and the 2228.95s - 2233.91s | premise of the book is basically that you can sort of jack into cyberspace physically and then 2233.91s - 2240.39s | interact with that environment. Um it's it's very cool but the connection here is that most of the 2240.39s - 2246.31s | time AI security is considered a subset of cyber security. Uh rightly or wrongly I I just want to 2246.31s - 2251.83s | ask everyone the question to consider. You know if if AI represents new risks and a new attack 2251.83s - 2257.27s | surface should it be considered a subset of cyber security or shouldn't it? So outside of policy 2257.27s - 2263.67s | we're starting to see uh more practitioner-based frameworks that address AI risk. So this example 2263.67s - 2268.63s | by NIST is pretty good. There's lots of other sorts of taxonomies and references out there. 2268.63s - 2274.23s | MITRE Atlas is a repository of all the TTPs of adversarial machine learning attacks for example. 2275.03s - 2279.03s | But we're still sort of going through this maturation process especially when everything 2279.03s - 2285.51s | is extremely AI safety focused. Um this is the model that I typically use to talk about AI 2285.51s


chunk_text:
is basically that you can sort of jack into cyberspace physically and then 2233.91s - 2240.39s | interact with that environment. Um it's it's very cool but the connection here is that most of the 2240.39s - 2246.31s | time AI security is considered a subset of cyber security. Uh rightly or wrongly I I just want to 2246.31s - 2251.83s | ask everyone the question to consider. You know if if AI represents new risks and a new attack 2251.83s - 2257.27s | surface should it be considered a subset of cyber security or shouldn't it? So outside of policy 2257.27s - 2263.67s | we're starting to see uh more practitioner-based frameworks that address AI risk. So this example 2263.67s - 2268.63s | by NIST is pretty good. There's lots of other sorts of taxonomies and references out there. 2268.63s - 2274.23s | MITRE Atlas is a repository of all the TTPs of adversarial machine learning attacks for example. 2275.03s - 2279.03s | But we're still sort of going through this maturation process especially when everything 2279.03s - 2285.51s | is extremely AI safety focused. Um this is the model that I typically use to talk about AI 2285.51s - 2292.23s | security threats. I talk about the three Ds. Those are disrupt, disclose and deceive. So if we're 2292.23s - 2297.75s | thinking about that panda versus gibbon example um if you're able to disrupt the model it means 2297.75s - 2303.43s | that that model basically just doesn't recognize that image as a panda. To deceive it means that 2303.43s - 2308.31s | it's able to recognize that image as something specific like something else like we want it to 2308.31s - 2313.59s | be specifically targeted as a gibbon and disclose means that you're able to leak information about 2313.59s - 2319.43s | the training data or something like that. A lot of the conversations I have with other AI people 2319.43s - 2324.15s | are very much that you know you can solve this problem through technology. Like if you create 2324.15s - 2329.99s | solutions that basically pen test AI systems um you don't need to think about people or process 2329.99s - 2335.67s | because the AI will be secure. And I can see from some of you in the room that you also don't 2335.67s - 2340.63s | agree with that premise


chunk_text:
- 2292.23s | security threats. I talk about the three Ds. Those are disrupt, disclose and deceive. So if we're 2292.23s - 2297.75s | thinking about that panda versus gibbon example um if you're able to disrupt the model it means 2297.75s - 2303.43s | that that model basically just doesn't recognize that image as a panda. To deceive it means that 2303.43s - 2308.31s | it's able to recognize that image as something specific like something else like we want it to 2308.31s - 2313.59s | be specifically targeted as a gibbon and disclose means that you're able to leak information about 2313.59s - 2319.43s | the training data or something like that. A lot of the conversations I have with other AI people 2319.43s - 2324.15s | are very much that you know you can solve this problem through technology. Like if you create 2324.15s - 2329.99s | solutions that basically pen test AI systems um you don't need to think about people or process 2329.99s - 2335.67s | because the AI will be secure. And I can see from some of you in the room that you also don't 2335.67s - 2340.63s | agree with that premise um because I definitely don't agree with that premise and most of the 2340.63s - 2347.51s | time it is actually a people and process issue. Um you know you can have as much secure technology 2347.51s - 2351.67s | as you want but if you're not able to actually create an environment where it supports that 2351.67s - 2360.23s | security um that's that's really challenging. So I'm sort of at time but I want to end on again 2360.23s - 2366.63s | because it's the policy village some discussion points um or maybe questions. I I we might have 2366.63s - 2371.99s | time for Q&A I'm not really sure but I'm really interested to understand from all of you in the 2371.99s - 2378.71s | room who obviously care about sort of the intersection of AI and security um to what 2378.71s - 2384.23s | extent you think that you know policy can actually address these kinds of challenges 2384.23s - 2392.39s | and how you know why is it that we're not seeing more um more action around AI security when 2392.39s - 2399.35s | cyber security is clearly such a big problem um for all


chunk_text:
um because I definitely don't agree with that premise and most of the 2340.63s - 2347.51s | time it is actually a people and process issue. Um you know you can have as much secure technology 2347.51s - 2351.67s | as you want but if you're not able to actually create an environment where it supports that 2351.67s - 2360.23s | security um that's that's really challenging. So I'm sort of at time but I want to end on again 2360.23s - 2366.63s | because it's the policy village some discussion points um or maybe questions. I I we might have 2366.63s - 2371.99s | time for Q&A I'm not really sure but I'm really interested to understand from all of you in the 2371.99s - 2378.71s | room who obviously care about sort of the intersection of AI and security um to what 2378.71s - 2384.23s | extent you think that you know policy can actually address these kinds of challenges 2384.23s - 2392.39s | and how you know why is it that we're not seeing more um more action around AI security when 2392.39s - 2399.35s | cyber security is clearly such a big problem um for all levels of society. You know the national 2399.35s - 2405.35s | security implications of AI um are extreme and we're just not seeing these lessons learnt being 2405.35s - 2410.95s | applied from cyber security and national security into AI security and so I hope that's something 2410.95s - 2415.35s | that maybe you take away with you and some questions that you can ask and I also really 2415.35s - 2421.43s | want to hear from you as well because I I want to see AI security more on the agenda. So um please 2421.43s - 2432.23s | do keep in touch. Um yeah I I do we have time for questions? No okay well stay in touch.


chunk_text:
levels of society. You know the national 2399.35s - 2405.35s | security implications of AI um are extreme and we're just not seeing these lessons learnt being 2405.35s - 2410.95s | applied from cyber security and national security into AI security and so I hope that's something 2410.95s - 2415.35s | that maybe you take away with you and some questions that you can ask and I also really 2415.35s - 2421.43s | want to hear from you as well because I I want to see AI security more on the agenda. So um please 2421.43s - 2432.23s | do keep in touch. Um yeah I I do we have time for questions? No okay well stay in touch.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=Q-rGVE9xCKw", "title": "DEF CON 32 - Responding to Breaches, Ransomware, and State Sponsored Threat Actors - Panel", "description": "For the past few years, we have had multiple instances of sophisticated cyber attacks ranging from ransomware attacks to attacks propagated by state sponsored threat actors; targeting elections, organizations, critical infrastructure etc. Organizations have had to step up and compensate with additional security controls and resources. We are living in a phase where even the most secure organizations are not immune to targeted cyber threats, the landscape of cyber security is in the state of constant evolution, with everybody playing to catch up.\n\nThis panel has been structured to delve into the complex and evolving nature of cyber adversaries. Beginning with an overview of recent cyber-attacks, breaches, and targeted ransomware incidents. We will also examine the rising wave of state sponsored threat actors, while focusing on their sophisticated adversary tactics, techniques and procedures.\n\nThis panel will focus on why organizations with even the most advanced cyber defense tooling and more than capable resources are still affected by breaches and threat actors. Our panel of experts will discuss the reasons behind these incidents and provide Insights into effective response and contentment strategies. Conversation will explore the critical components of how efficiently respond to threats, contain, and remediate them.\n\nAdditionally, the panel will also touch upon how threat intel assisted adversarial attack simulation, offensive cyber security operations could be used as proactive measures in enhancing an organization\u2019s defense posture, offering valuable insights into the mindset and methodologies of potential attackers.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2952, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 1.48s | This text was transcribed using whisper model: large-v2 Hey, everyone. 1.48s - 3.16s | Good morning. 3.16s - 5.24s | Morning, DEF CON. 5.24s - 6.84s | Good morning. 6.84s - 7.84s | Just come on. 7.84s - 11.84s | I flew like 20 hours from India to Las Vegas. 11.84s - 12.64s | Come on. 12.64s - 15.73s | Good morning, DEF CON. 15.73s - 17.49s | Now we got it. 17.49s - 19.69s | So we have an amazing panel here. 19.69s - 23.25s | My name is Abhijit Babirajan Renuga. 23.25s - 24.85s | I know how that sounds. 24.85s - 26.81s | So I call myself ABX. 26.81s - 29.41s | Much, much shorter so that the people will not 29.41s - 31.57s | be ruining


chunk_text:
will explore the critical components of how efficiently respond to threats, contain, and remediate them.\n\nAdditionally, the panel will also touch upon how threat intel assisted adversarial attack simulation, offensive cyber security operations could be used as proactive measures in enhancing an organization\u2019s defense posture, offering valuable insights into the mindset and methodologies of potential attackers.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2952, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 1.48s | This text was transcribed using whisper model: large-v2 Hey, everyone. 1.48s - 3.16s | Good morning. 3.16s - 5.24s | Morning, DEF CON. 5.24s - 6.84s | Good morning. 6.84s - 7.84s | Just come on. 7.84s - 11.84s | I flew like 20 hours from India to Las Vegas. 11.84s - 12.64s | Come on. 12.64s - 15.73s | Good morning, DEF CON. 15.73s - 17.49s | Now we got it. 17.49s - 19.69s | So we have an amazing panel here. 19.69s - 23.25s | My name is Abhijit Babirajan Renuga. 23.25s - 24.85s | I know how that sounds. 24.85s - 26.81s | So I call myself ABX. 26.81s - 29.41s | Much, much shorter so that the people will not 29.41s - 31.57s | be ruining my night, right? 31.57s - 33.21s | So I used to be called many things, 33.21s - 36.53s | but ABX is kind of very, very simple. 36.53s - 37.65s | I manage. 37.65s - 40.77s | I lead the advocacy village at DEF CON for the past, 40.77s - 42.85s | like, 45 years, right? 42.85s - 44.37s | So we are all there. 44.37s - 46.41s | After this panel, maybe you can come there, 46.41s - 48.61s | listen to the talks, workshops, all this amazing stuff 48.61s - 50.17s | happening in there. 50.17s - 53.73s | And I'm handing over the mic to the amazing panel here. 53.73s - 56.09s | They will introduce themselves, and we 56.09s - 61.12s | can start insulting each other. 61.12s - 62.00s | I'll go. 62.00s - 64.60s | I'm what's-his-face Adam Pennington. 64.60s - 67.64s | I'm with a nonprofit called the MITRE Corporation, 67.64s - 71.16s | where I run a cybersecurity framework called MITRE ATT&CK. 71.16s - 73.88s | I've been with MITRE a long, long time at this point. 73.88s - 75.52s | I helped gather a lot of the data 75.52s - 76.92s


chunk_text:
my night, right? 31.57s - 33.21s | So I used to be called many things, 33.21s - 36.53s | but ABX is kind of very, very simple. 36.53s - 37.65s | I manage. 37.65s - 40.77s | I lead the advocacy village at DEF CON for the past, 40.77s - 42.85s | like, 45 years, right? 42.85s - 44.37s | So we are all there. 44.37s - 46.41s | After this panel, maybe you can come there, 46.41s - 48.61s | listen to the talks, workshops, all this amazing stuff 48.61s - 50.17s | happening in there. 50.17s - 53.73s | And I'm handing over the mic to the amazing panel here. 53.73s - 56.09s | They will introduce themselves, and we 56.09s - 61.12s | can start insulting each other. 61.12s - 62.00s | I'll go. 62.00s - 64.60s | I'm what's-his-face Adam Pennington. 64.60s - 67.64s | I'm with a nonprofit called the MITRE Corporation, 67.64s - 71.16s | where I run a cybersecurity framework called MITRE ATT&CK. 71.16s - 73.88s | I've been with MITRE a long, long time at this point. 73.88s - 75.52s | I helped gather a lot of the data 75.52s - 76.92s | that we used to originally create 76.92s - 81.12s | ATT&CK through a series of honeypots with state actors. 81.12s - 86.15s | And so I've been watching this space for a pretty long time. 86.15s - 87.99s | Hi, I'm Stryker. 87.99s - 90.83s | I am the head of security communications and planning 90.83s - 91.75s | and SCP. 91.75s - 95.47s | And yes, that acronym was on purpose. 95.47s - 97.07s | With the Adversary Pursuit Group, 97.07s - 99.59s | that's the Threat Intel and Threat Research Unit 99.59s - 101.47s | within Blackpoint Cyber. 101.47s - 103.63s | We're an MDR, which means that we actually 103.63s - 108.71s | get a lot of information from both the feedback. 108.71s - 111.43s | We get a lot of information from both end user environments, 111.43s - 114.71s | from a wide range of clients, from health care 114.71s - 116.83s | and critical infrastructure, all the way 116.83s - 119.23s | through your service-based industries, 119.23s - 121.51s | and your local mom-and-pop shop. 121.51s - 124.75s | And so we get both the supply chain moments 124.75s - 128.31s | of them


chunk_text:
| that we used to originally create 76.92s - 81.12s | ATT&CK through a series of honeypots with state actors. 81.12s - 86.15s | And so I've been watching this space for a pretty long time. 86.15s - 87.99s | Hi, I'm Stryker. 87.99s - 90.83s | I am the head of security communications and planning 90.83s - 91.75s | and SCP. 91.75s - 95.47s | And yes, that acronym was on purpose. 95.47s - 97.07s | With the Adversary Pursuit Group, 97.07s - 99.59s | that's the Threat Intel and Threat Research Unit 99.59s - 101.47s | within Blackpoint Cyber. 101.47s - 103.63s | We're an MDR, which means that we actually 103.63s - 108.71s | get a lot of information from both the feedback. 108.71s - 111.43s | We get a lot of information from both end user environments, 111.43s - 114.71s | from a wide range of clients, from health care 114.71s - 116.83s | and critical infrastructure, all the way 116.83s - 119.23s | through your service-based industries, 119.23s - 121.51s | and your local mom-and-pop shop. 121.51s - 124.75s | And so we get both the supply chain moments 124.75s - 128.31s | of them attacking directly the MSPs and then our end clients, 128.31s - 130.95s | which leads to some really interesting research 130.95s - 132.87s | and intel that our teams have been working on. 132.87s - 134.63s | So looking forward to sharing that. 134.63s - 137.51s | Oh, also, if you're going to pitch the Adversary Village, 137.51s - 140.35s | come visit later at the Lonely Hackers Club. 140.35s - 141.15s | I am an admin. 141.15s - 142.39s | It's lots of fun. 142.39s - 143.63s | And then the XR Village. 143.63s - 150.33s | So. 150.33s - 152.37s | What's up? 152.45s - 155.37s | I'm the guy that can't work a microphone. 155.37s - 156.09s | My name's Ken. 156.09s - 159.17s | I'm the VP of AI for Omni Federal. 159.17s - 161.81s | Previous to that role, I was a White House Presidential 161.81s - 163.29s | Innovation Fellow for four years, 163.29s - 166.57s | where I got to see some pretty interesting fun attacks. 166.57s - 168.21s | And I'm looking forward to sharing 168.21s - 172.05s | some of those experiences with you all today. 172.05s - 172.97s | Hi,


chunk_text:
attacking directly the MSPs and then our end clients, 128.31s - 130.95s | which leads to some really interesting research 130.95s - 132.87s | and intel that our teams have been working on. 132.87s - 134.63s | So looking forward to sharing that. 134.63s - 137.51s | Oh, also, if you're going to pitch the Adversary Village, 137.51s - 140.35s | come visit later at the Lonely Hackers Club. 140.35s - 141.15s | I am an admin. 141.15s - 142.39s | It's lots of fun. 142.39s - 143.63s | And then the XR Village. 143.63s - 150.33s | So. 150.33s - 152.37s | What's up? 152.45s - 155.37s | I'm the guy that can't work a microphone. 155.37s - 156.09s | My name's Ken. 156.09s - 159.17s | I'm the VP of AI for Omni Federal. 159.17s - 161.81s | Previous to that role, I was a White House Presidential 161.81s - 163.29s | Innovation Fellow for four years, 163.29s - 166.57s | where I got to see some pretty interesting fun attacks. 166.57s - 168.21s | And I'm looking forward to sharing 168.21s - 172.05s | some of those experiences with you all today. 172.05s - 172.97s | Hi, everyone. 172.97s - 174.45s | I'm Nikhil Mittal. 174.45s - 176.05s | I'm the founder of Altered Security. 176.05s - 179.37s | We are a small organization that train people 179.37s - 182.45s | in red teaming, on-prem, Azure, et cetera. 182.45s - 185.25s | So we expect some stuff on Microsoft from me. 185.25s - 188.85s | I'm pretty interested in that. 188.85s - 191.21s | Now that the introductions are over, 191.21s - 193.85s | I'm going to start from the right end with Adam. 193.85s - 196.09s | So like I mentioned, the panel topic 196.09s - 199.37s | is about the formidable adversaries and threat actor. 199.37s - 203.45s | So I think Adam has a long experience on identifying 203.45s - 207.57s | and putting these threat actors in the light. 207.57s - 211.89s | So ATT&CK tracks publicly available threat intelligence 211.89s - 214.85s | information on lots of different adversary groups. 214.85s - 218.09s | And we've been doing that since our creation back in 2013 218.09s - 218.97s | to 2015. 218.97s - 220.93s | And so everything I'm going to be talking about 220.93s - 223.17s | is coming from publicly


chunk_text:
everyone. 172.97s - 174.45s | I'm Nikhil Mittal. 174.45s - 176.05s | I'm the founder of Altered Security. 176.05s - 179.37s | We are a small organization that train people 179.37s - 182.45s | in red teaming, on-prem, Azure, et cetera. 182.45s - 185.25s | So we expect some stuff on Microsoft from me. 185.25s - 188.85s | I'm pretty interested in that. 188.85s - 191.21s | Now that the introductions are over, 191.21s - 193.85s | I'm going to start from the right end with Adam. 193.85s - 196.09s | So like I mentioned, the panel topic 196.09s - 199.37s | is about the formidable adversaries and threat actor. 199.37s - 203.45s | So I think Adam has a long experience on identifying 203.45s - 207.57s | and putting these threat actors in the light. 207.57s - 211.89s | So ATT&CK tracks publicly available threat intelligence 211.89s - 214.85s | information on lots of different adversary groups. 214.85s - 218.09s | And we've been doing that since our creation back in 2013 218.09s - 218.97s | to 2015. 218.97s - 220.93s | And so everything I'm going to be talking about 220.93s - 223.17s | is coming from publicly available open source 223.17s - 225.01s | intelligence sources. 225.01s - 228.05s | But state hackers are not a new thing. 228.05s - 230.01s | We've known about it for a long time. 230.01s - 231.61s | It's been going on for a while. 231.61s - 233.97s | It's been in the public eye for a pretty long time 234.21s - 238.09s | back to the cuckoo's nest in the 80s, which 238.09s - 242.13s | might have had a role in, not a terrific one. 242.13s - 245.37s | And so it's been something that has been out there. 245.37s - 248.93s | We saw a lot more awareness coming with the APT1 report 248.93s - 252.21s | and then Russian hacking with the elections. 252.21s - 254.17s | And so we've seen a lot of these waves, 254.17s - 256.25s | North Korean ransomware. 256.25s - 259.29s | And more recently, we've seen a lot of activity 259.29s - 261.73s | where China has become prevalent again, 261.77s - 264.37s | where we're seeing sophisticated activity happening 264.37s - 269.37s | across a lot of organizations, some successful activity. 269.37s - 272.37s | And so we're seeing trends


chunk_text:
available open source 223.17s - 225.01s | intelligence sources. 225.01s - 228.05s | But state hackers are not a new thing. 228.05s - 230.01s | We've known about it for a long time. 230.01s - 231.61s | It's been going on for a while. 231.61s - 233.97s | It's been in the public eye for a pretty long time 234.21s - 238.09s | back to the cuckoo's nest in the 80s, which 238.09s - 242.13s | might have had a role in, not a terrific one. 242.13s - 245.37s | And so it's been something that has been out there. 245.37s - 248.93s | We saw a lot more awareness coming with the APT1 report 248.93s - 252.21s | and then Russian hacking with the elections. 252.21s - 254.17s | And so we've seen a lot of these waves, 254.17s - 256.25s | North Korean ransomware. 256.25s - 259.29s | And more recently, we've seen a lot of activity 259.29s - 261.73s | where China has become prevalent again, 261.77s - 264.37s | where we're seeing sophisticated activity happening 264.37s - 269.37s | across a lot of organizations, some successful activity. 269.37s - 272.37s | And so we're seeing trends in a lot of these spaces. 272.37s - 275.17s | I flinch a little bit at the word sophisticated. 275.17s - 277.25s | I know it was in the panel description, 277.25s - 281.81s | but most threat actors are exactly as sophisticated 281.81s - 284.37s | as they need to be in a given situation. 284.37s - 287.97s | If they're any good, they're not usually pulling out 287.97s - 290.81s | sort of the big guns unless they have to. 290.81s - 293.73s | But in places where we've been seeing the defenses 293.73s - 296.93s | get a lot better, people are watching their networks, 296.93s - 298.89s | people watching their end systems, 298.89s - 301.45s | and it's gotten a lot harder to work your way 301.45s - 302.81s | through a network. 302.81s - 305.77s | Those of you who are red teamers probably know this too, 305.77s - 307.53s | that the space has gotten harder. 307.53s - 311.01s | And so we've seen adversaries who are interested 311.01s - 313.93s | in not getting caught and sometimes ransomware, 313.93s - 317.57s | not so much, but a state actor that wants to


chunk_text:
in a lot of these spaces. 272.37s - 275.17s | I flinch a little bit at the word sophisticated. 275.17s - 277.25s | I know it was in the panel description, 277.25s - 281.81s | but most threat actors are exactly as sophisticated 281.81s - 284.37s | as they need to be in a given situation. 284.37s - 287.97s | If they're any good, they're not usually pulling out 287.97s - 290.81s | sort of the big guns unless they have to. 290.81s - 293.73s | But in places where we've been seeing the defenses 293.73s - 296.93s | get a lot better, people are watching their networks, 296.93s - 298.89s | people watching their end systems, 298.89s - 301.45s | and it's gotten a lot harder to work your way 301.45s - 302.81s | through a network. 302.81s - 305.77s | Those of you who are red teamers probably know this too, 305.77s - 307.53s | that the space has gotten harder. 307.53s - 311.01s | And so we've seen adversaries who are interested 311.01s - 313.93s | in not getting caught and sometimes ransomware, 313.93s - 317.57s | not so much, but a state actor that wants to steal 317.57s - 322.25s | information and be in a network for months or years 322.25s - 325.73s | needs to not get caught or not get completely caught 325.73s - 328.29s | in order to meet their goals. 328.29s - 331.29s | And so we're seeing a more and more of a trend 331.29s - 335.05s | of adversaries getting into places that we don't watch. 335.89s - 337.73s | And so it's a natural place to be. 337.73s - 340.81s | It's nothing that we didn't know was possible. 340.81s - 343.45s | It's not incredibly surprising, 343.45s - 345.41s | but adversaries getting into routers. 345.45s - 348.21s | We saw a lot of reporting on routers last year 348.21s - 350.09s | and system security devices. 350.09s - 353.01s | So finding a lot of zero days in the devices 353.01s - 355.49s | that we actually bought to protect our networks, 355.49s - 358.53s | getting into those and using those as pivot points 358.53s - 362.69s | has been a popular trend to get into VMware ESX servers. 362.69s - 366.93s | So getting into places where we can't run an ADR, 366.93s -


chunk_text:
steal 317.57s - 322.25s | information and be in a network for months or years 322.25s - 325.73s | needs to not get caught or not get completely caught 325.73s - 328.29s | in order to meet their goals. 328.29s - 331.29s | And so we're seeing a more and more of a trend 331.29s - 335.05s | of adversaries getting into places that we don't watch. 335.89s - 337.73s | And so it's a natural place to be. 337.73s - 340.81s | It's nothing that we didn't know was possible. 340.81s - 343.45s | It's not incredibly surprising, 343.45s - 345.41s | but adversaries getting into routers. 345.45s - 348.21s | We saw a lot of reporting on routers last year 348.21s - 350.09s | and system security devices. 350.09s - 353.01s | So finding a lot of zero days in the devices 353.01s - 355.49s | that we actually bought to protect our networks, 355.49s - 358.53s | getting into those and using those as pivot points 358.53s - 362.69s | has been a popular trend to get into VMware ESX servers. 362.69s - 366.93s | So getting into places where we can't run an ADR, 366.93s - 370.01s | they're not supported, we don't know how to see there. 370.01s - 372.85s | And so you're more and more buried into the system. 372.85s - 375.01s | We've also seen a trend lately with adversaries 375.61s - 376.85s | getting into security cameras. 376.85s - 381.01s | And so crappy Linux devices that we have no security on 381.01s - 383.33s | have no way of adding security to. 383.33s - 385.53s | And so we're gonna have to be looking at some other places 385.53s - 390.95s | to actually spot this activity. 390.95s - 393.31s | That actually reflects a lot of what we've been seeing 393.31s - 395.63s | in the wild with a lot of our different client bases, 395.63s - 397.15s | to be honest. 397.15s - 401.23s | I would say that in addition to some of the really neat 401.23s - 403.83s | hackery kind of almost admirable things 403.87s - 408.07s | and sophisticated, maybe less just clever, 408.07s - 410.95s | unexpected ways that nation state level 410.95s - 412.43s | threat actors are using, 412.43s - 415.59s | they do make their way down into the pipeline.


chunk_text:
370.01s | they're not supported, we don't know how to see there. 370.01s - 372.85s | And so you're more and more buried into the system. 372.85s - 375.01s | We've also seen a trend lately with adversaries 375.61s - 376.85s | getting into security cameras. 376.85s - 381.01s | And so crappy Linux devices that we have no security on 381.01s - 383.33s | have no way of adding security to. 383.33s - 385.53s | And so we're gonna have to be looking at some other places 385.53s - 390.95s | to actually spot this activity. 390.95s - 393.31s | That actually reflects a lot of what we've been seeing 393.31s - 395.63s | in the wild with a lot of our different client bases, 395.63s - 397.15s | to be honest. 397.15s - 401.23s | I would say that in addition to some of the really neat 401.23s - 403.83s | hackery kind of almost admirable things 403.87s - 408.07s | and sophisticated, maybe less just clever, 408.07s - 410.95s | unexpected ways that nation state level 410.95s - 412.43s | threat actors are using, 412.43s - 415.59s | they do make their way down into the pipeline. 415.59s - 417.99s | There is a whole undercurrent on the dark web 417.99s - 421.79s | of people selling everything from malware and ransomware 421.79s - 424.19s | to initial access and even phishing as a service. 424.19s - 427.11s | I have seen extremely sophisticated UI 427.11s - 429.83s | that look like HubSpot or Salesforce 429.83s - 432.39s | is gonna send you an email like no before, 432.39s - 433.47s | but for bad guys. 434.11s - 435.35s | It's pretty sophisticated. 435.35s - 437.63s | So the tactics and techniques that we're seeing 437.63s - 439.67s | at the APT level eventually do trickle down 439.67s - 443.07s | to the script kitties who are just spamming out things 443.07s - 446.79s | to all of the different organizations at the same time. 446.79s - 450.79s | And one of the things to add to that is going to be, 450.79s - 454.35s | we're seeing a lot more of living off the land tactics. 455.43s - 459.03s | People who are using and abusing either red team tools 459.03s - 462.35s | that were developed explicitly for research, 462.35s - 464.47s | impact it,


chunk_text:
415.59s - 417.99s | There is a whole undercurrent on the dark web 417.99s - 421.79s | of people selling everything from malware and ransomware 421.79s - 424.19s | to initial access and even phishing as a service. 424.19s - 427.11s | I have seen extremely sophisticated UI 427.11s - 429.83s | that look like HubSpot or Salesforce 429.83s - 432.39s | is gonna send you an email like no before, 432.39s - 433.47s | but for bad guys. 434.11s - 435.35s | It's pretty sophisticated. 435.35s - 437.63s | So the tactics and techniques that we're seeing 437.63s - 439.67s | at the APT level eventually do trickle down 439.67s - 443.07s | to the script kitties who are just spamming out things 443.07s - 446.79s | to all of the different organizations at the same time. 446.79s - 450.79s | And one of the things to add to that is going to be, 450.79s - 454.35s | we're seeing a lot more of living off the land tactics. 455.43s - 459.03s | People who are using and abusing either red team tools 459.03s - 462.35s | that were developed explicitly for research, 462.35s - 464.47s | impact it, et cetera, 464.47s - 468.15s | or they're using and abusing scripts and systems 468.15s - 470.63s | and controls within the endpoints themselves 470.63s - 472.39s | that were designed for system admins 472.39s - 473.43s | to make their lives easier. 473.43s - 476.23s | I mean, remote desktop protocol guys, 476.23s - 479.59s | like it's designed for somebody with privilege 479.59s - 482.15s | to go in and fix another user's computer. 482.15s - 483.95s | Boy, I can't imagine how an adversary 483.95s - 485.55s | is gonna use that, right? 485.55s - 487.79s | That's an easy lateral movement. 487.79s - 490.51s | And you get such friction from the business side 490.51s - 492.39s | to turn that off because what's the solution 492.39s - 494.31s | in an increasingly remote world? 494.31s - 496.87s | So really what we've discovered is one, 496.87s - 498.27s | you have to be really careful. 498.27s - 500.15s | Allow listing and block listing 500.15s - 502.51s | doesn't matter as much anymore. 502.51s - 504.19s | I mean, obviously make sure 504.19s - 506.51s | that you have a centralized software center 506.51s -


chunk_text:
et cetera, 464.47s - 468.15s | or they're using and abusing scripts and systems 468.15s - 470.63s | and controls within the endpoints themselves 470.63s - 472.39s | that were designed for system admins 472.39s - 473.43s | to make their lives easier. 473.43s - 476.23s | I mean, remote desktop protocol guys, 476.23s - 479.59s | like it's designed for somebody with privilege 479.59s - 482.15s | to go in and fix another user's computer. 482.15s - 483.95s | Boy, I can't imagine how an adversary 483.95s - 485.55s | is gonna use that, right? 485.55s - 487.79s | That's an easy lateral movement. 487.79s - 490.51s | And you get such friction from the business side 490.51s - 492.39s | to turn that off because what's the solution 492.39s - 494.31s | in an increasingly remote world? 494.31s - 496.87s | So really what we've discovered is one, 496.87s - 498.27s | you have to be really careful. 498.27s - 500.15s | Allow listing and block listing 500.15s - 502.51s | doesn't matter as much anymore. 502.51s - 504.19s | I mean, obviously make sure 504.19s - 506.51s | that you have a centralized software center 506.51s - 508.99s | and we can get more into remediations later. 508.99s - 511.51s | But the major threat actors we've been seeing lately 511.51s - 514.87s | have just been using and abusing these particular tools. 514.87s - 516.99s | And so it's time that we stop talking 516.99s - 518.71s | about IOCs explicitly. 518.71s - 521.83s | And it's time that we start talking, to Mitre's point, 521.83s - 523.87s | about how they're abusing these tools 523.87s - 525.79s | and how we can sense that change in behavior 525.79s - 530.34s | if you really wanna do something about it. 530.34s - 534.62s | The biggest thing that I always think about 534.62s - 538.90s | when considering state-sponsored attacks is scale. 538.90s - 540.54s | It's the amount of resources 540.54s - 542.98s | that state sponsors can commit to it. 542.98s - 546.26s | It's entire job and workforce. 546.26s - 549.94s | So the days are gone when I could reliably hope 549.94s - 551.18s | for a single adversary. 551.18s - 552.70s | That's never the case. 553.62s - 558.14s | So now I'm up against teams who has a lot of


chunk_text:
508.99s | and we can get more into remediations later. 508.99s - 511.51s | But the major threat actors we've been seeing lately 511.51s - 514.87s | have just been using and abusing these particular tools. 514.87s - 516.99s | And so it's time that we stop talking 516.99s - 518.71s | about IOCs explicitly. 518.71s - 521.83s | And it's time that we start talking, to Mitre's point, 521.83s - 523.87s | about how they're abusing these tools 523.87s - 525.79s | and how we can sense that change in behavior 525.79s - 530.34s | if you really wanna do something about it. 530.34s - 534.62s | The biggest thing that I always think about 534.62s - 538.90s | when considering state-sponsored attacks is scale. 538.90s - 540.54s | It's the amount of resources 540.54s - 542.98s | that state sponsors can commit to it. 542.98s - 546.26s | It's entire job and workforce. 546.26s - 549.94s | So the days are gone when I could reliably hope 549.94s - 551.18s | for a single adversary. 551.18s - 552.70s | That's never the case. 553.62s - 558.14s | So now I'm up against teams who has a lot of money, 559.06s - 563.22s | a lot of compute, and very, very distributed 563.22s - 565.06s | with interesting, sophisticated attacks 565.06s - 567.70s | to spend their own R&D money on. 567.70s - 570.50s | That's the landscape of sponsored attacks. 571.38s - 573.82s | And that's up to your point, that's trickled down, 573.82s - 575.82s | where we're now seeing the dark net, 575.82s - 578.34s | some of those same tech from a few years back 578.34s - 580.02s | available as a service. 581.06s - 585.78s | And the next evolution to change the individual players 585.78s - 588.34s | are models like WhiteRabbit Neo 588.34s - 593.14s | that allows you to ask AI without guardrails, 593.14s - 595.34s | hey, how do I do a DDoS? 595.34s - 598.98s | And it gives you a pretty simple example in Python. 598.98s - 601.66s | So now we have tools that can supercharge 601.66s - 604.38s | the average person to become a one-person team. 604.38s - 607.58s | And that is pretty terrifying to think about. 607.58s - 610.50s | And now let's add that to the state-sponsored level. 610.50s - 613.30s |


chunk_text:
money, 559.06s - 563.22s | a lot of compute, and very, very distributed 563.22s - 565.06s | with interesting, sophisticated attacks 565.06s - 567.70s | to spend their own R&D money on. 567.70s - 570.50s | That's the landscape of sponsored attacks. 571.38s - 573.82s | And that's up to your point, that's trickled down, 573.82s - 575.82s | where we're now seeing the dark net, 575.82s - 578.34s | some of those same tech from a few years back 578.34s - 580.02s | available as a service. 581.06s - 585.78s | And the next evolution to change the individual players 585.78s - 588.34s | are models like WhiteRabbit Neo 588.34s - 593.14s | that allows you to ask AI without guardrails, 593.14s - 595.34s | hey, how do I do a DDoS? 595.34s - 598.98s | And it gives you a pretty simple example in Python. 598.98s - 601.66s | So now we have tools that can supercharge 601.66s - 604.38s | the average person to become a one-person team. 604.38s - 607.58s | And that is pretty terrifying to think about. 607.58s - 610.50s | And now let's add that to the state-sponsored level. 610.50s - 613.30s | All that R&D money, all that resource, 613.30s - 615.62s | all that GPU access, 615.62s - 621.18s | that's the current reality we're up against. 621.18s - 626.18s | Okay, so I would agree to what other panelists say, 627.30s - 629.34s | but one thing that I would like to add here 629.34s - 634.34s | is when we talk about advanced adversaries, 634.66s - 637.54s | are we really defending even for normal attacks? 637.54s - 640.58s | So if you look at any previous hack, 640.58s - 642.82s | as I said, Microsoft, for example, 642.82s - 645.50s | if an organization at the level of Microsoft, 645.50s - 647.38s | or for that matter, any tech organization, 647.38s - 650.98s | they can't compromise just using a password spray attack. 650.98s - 654.94s | That's not absolutely anything that is sophisticated. 654.94s - 657.26s | You know, just so blowing our own trumpet here. 657.26s - 660.78s | So when we teach, let's say Azure Red Teaming, 660.78s - 663.98s | we don't even consider password spraying as a valid attack. 663.98s - 665.14s | We mentioned that and we said, 665.14s - 667.74s |


chunk_text:
All that R&D money, all that resource, 613.30s - 615.62s | all that GPU access, 615.62s - 621.18s | that's the current reality we're up against. 621.18s - 626.18s | Okay, so I would agree to what other panelists say, 627.30s - 629.34s | but one thing that I would like to add here 629.34s - 634.34s | is when we talk about advanced adversaries, 634.66s - 637.54s | are we really defending even for normal attacks? 637.54s - 640.58s | So if you look at any previous hack, 640.58s - 642.82s | as I said, Microsoft, for example, 642.82s - 645.50s | if an organization at the level of Microsoft, 645.50s - 647.38s | or for that matter, any tech organization, 647.38s - 650.98s | they can't compromise just using a password spray attack. 650.98s - 654.94s | That's not absolutely anything that is sophisticated. 654.94s - 657.26s | You know, just so blowing our own trumpet here. 657.26s - 660.78s | So when we teach, let's say Azure Red Teaming, 660.78s - 663.98s | we don't even consider password spraying as a valid attack. 663.98s - 665.14s | We mentioned that and we said, 665.14s - 667.74s | okay, this is not going to work against Azure 667.74s - 668.58s | without testing. 668.58s - 671.02s | I mean, that is the sort of confidence we had, 671.02s - 673.50s | we used to have on Microsoft. 673.50s - 675.98s | So what I think is lacking, 675.98s - 679.58s | whether it is the advanced adversaries 679.58s - 681.74s | or your good attackers like penetration testers 681.74s - 684.78s | or Red Teamers, is the basic hygiene. 684.78s - 689.02s | Are we still leaving credentials in clear text on shares 689.02s - 690.54s | in an internal environment? 690.54s - 692.38s | Well, yes, probably. 692.38s - 695.34s | So that doesn't need any research, 695.34s - 697.54s | any research budget at all. 697.54s - 700.94s | So that is what I would like to bring in. 700.94s - 703.22s | Go for the basic hygiene. 703.22s - 707.50s | Doesn't need an advanced adversary to read your credentials 707.50s - 709.74s | or, you know, have an SMB relay attack, 709.74s - 711.82s | or for that matter, I mean, you know, 711.82s - 715.86s | sending a phishing link to one of


chunk_text:
okay, this is not going to work against Azure 667.74s - 668.58s | without testing. 668.58s - 671.02s | I mean, that is the sort of confidence we had, 671.02s - 673.50s | we used to have on Microsoft. 673.50s - 675.98s | So what I think is lacking, 675.98s - 679.58s | whether it is the advanced adversaries 679.58s - 681.74s | or your good attackers like penetration testers 681.74s - 684.78s | or Red Teamers, is the basic hygiene. 684.78s - 689.02s | Are we still leaving credentials in clear text on shares 689.02s - 690.54s | in an internal environment? 690.54s - 692.38s | Well, yes, probably. 692.38s - 695.34s | So that doesn't need any research, 695.34s - 697.54s | any research budget at all. 697.54s - 700.94s | So that is what I would like to bring in. 700.94s - 703.22s | Go for the basic hygiene. 703.22s - 707.50s | Doesn't need an advanced adversary to read your credentials 707.50s - 709.74s | or, you know, have an SMB relay attack, 709.74s - 711.82s | or for that matter, I mean, you know, 711.82s - 715.86s | sending a phishing link to one of your employees. 715.86s - 719.62s | So defense in depth, not even that basic security hygiene, 719.62s - 721.94s | if you follow that, you can actually stop, 722.34s - 724.42s | using it once again from Microsoft's marketing, 724.42s - 726.14s | 99% of the attacks. 726.14s - 727.38s | That's true. 727.38s - 729.94s | So that is what my point is. 729.94s - 736.43s | On top of that, I would add something for Red Teamers, 736.43s - 737.83s | give them time. 737.83s - 740.19s | If you are in an organization, 745.41s - 747.49s | if you're in a position to make a decision, 747.49s - 750.33s | do not get your Red Team operations done in a week. 750.33s - 752.09s | Don't do that, please. 752.09s - 754.17s | Provide the good attackers more time. 754.17s - 757.45s | You know, APTs include the word persistent. 757.45s - 760.49s | Have persistently tested your stuff. 760.49s - 762.69s | It's not going to happen in a week or two, 762.69s - 766.29s | where you give a couple of IPs to your good attackers 766.29s - 768.85s | and say that, okay, these


chunk_text:
your employees. 715.86s - 719.62s | So defense in depth, not even that basic security hygiene, 719.62s - 721.94s | if you follow that, you can actually stop, 722.34s - 724.42s | using it once again from Microsoft's marketing, 724.42s - 726.14s | 99% of the attacks. 726.14s - 727.38s | That's true. 727.38s - 729.94s | So that is what my point is. 729.94s - 736.43s | On top of that, I would add something for Red Teamers, 736.43s - 737.83s | give them time. 737.83s - 740.19s | If you are in an organization, 745.41s - 747.49s | if you're in a position to make a decision, 747.49s - 750.33s | do not get your Red Team operations done in a week. 750.33s - 752.09s | Don't do that, please. 752.09s - 754.17s | Provide the good attackers more time. 754.17s - 757.45s | You know, APTs include the word persistent. 757.45s - 760.49s | Have persistently tested your stuff. 760.49s - 762.69s | It's not going to happen in a week or two, 762.69s - 766.29s | where you give a couple of IPs to your good attackers 766.29s - 768.85s | and say that, okay, these are our firewall IPs. 768.85s - 771.05s | Let's see if you can get your domain admin. 771.05s - 773.73s | That's not unfortunately how it is going to be 773.73s - 775.17s | for the actual attackers. 776.01s - 777.65s | Yeah, and one more thing for the Red Teamers, 777.65s - 779.09s | domain admin is not everything. 779.09s - 781.13s | Don't go for that all the time. 782.33s - 783.33s | Yeah, that's for me. 786.06s - 788.10s | What is this, Amit? 788.10s - 790.10s | I stand with Nikhil on this 790.10s - 795.02s | because he taught a generation of AI hackers in India 795.02s - 797.58s | with respect to Red Teaming, right? 797.58s - 799.66s | I also would like to add a point in there, 799.66s - 801.02s | a humiliating one. 801.02s - 805.22s | So I was performing Red Teaming for one of my clients, right? 805.22s - 807.54s | I'm not going to tell Derek Knight, maybe. 807.54s - 808.94s | I'm not, okay. 808.94s - 809.90s | I should not. 809.90s - 813.42s | So I found a service, like he mentioned, the hygiene. 813.46s -


chunk_text:
are our firewall IPs. 768.85s - 771.05s | Let's see if you can get your domain admin. 771.05s - 773.73s | That's not unfortunately how it is going to be 773.73s - 775.17s | for the actual attackers. 776.01s - 777.65s | Yeah, and one more thing for the Red Teamers, 777.65s - 779.09s | domain admin is not everything. 779.09s - 781.13s | Don't go for that all the time. 782.33s - 783.33s | Yeah, that's for me. 786.06s - 788.10s | What is this, Amit? 788.10s - 790.10s | I stand with Nikhil on this 790.10s - 795.02s | because he taught a generation of AI hackers in India 795.02s - 797.58s | with respect to Red Teaming, right? 797.58s - 799.66s | I also would like to add a point in there, 799.66s - 801.02s | a humiliating one. 801.02s - 805.22s | So I was performing Red Teaming for one of my clients, right? 805.22s - 807.54s | I'm not going to tell Derek Knight, maybe. 807.54s - 808.94s | I'm not, okay. 808.94s - 809.90s | I should not. 809.90s - 813.42s | So I found a service, like he mentioned, the hygiene. 813.46s - 815.70s | I have seen a service account in there 815.70s - 819.74s | that has been waiting for me for the last 18 years. 819.74s - 822.50s | They created that service account in there 822.50s - 824.54s | when I was studying in my, I don't know, 824.54s - 826.46s | maybe eighth or ninth standard. 826.46s - 828.70s | And it was there for like waiting for me. 828.70s - 829.70s | Come and break me. 829.70s - 830.90s | Come and break me. 830.90s - 832.46s | I'm waiting for you, right? 832.46s - 834.54s | It was there for 18 years. 834.54s - 837.18s | It was like within a couple of minutes we got that. 837.18s - 838.02s | I was amazed. 838.02s - 841.02s | Okay, this is when the password was last changed. 841.06s - 844.58s | That was in 2002, I guess, right? 844.58s - 846.94s | This is, the basic security hygiene is important 846.94s - 849.66s | because if you're looking at the attacks happening 849.66s - 851.62s | around the globe, they are not, 851.62s - 853.02s | sometimes they are not even using 853.02s - 855.02s |


chunk_text:
815.70s | I have seen a service account in there 815.70s - 819.74s | that has been waiting for me for the last 18 years. 819.74s - 822.50s | They created that service account in there 822.50s - 824.54s | when I was studying in my, I don't know, 824.54s - 826.46s | maybe eighth or ninth standard. 826.46s - 828.70s | And it was there for like waiting for me. 828.70s - 829.70s | Come and break me. 829.70s - 830.90s | Come and break me. 830.90s - 832.46s | I'm waiting for you, right? 832.46s - 834.54s | It was there for 18 years. 834.54s - 837.18s | It was like within a couple of minutes we got that. 837.18s - 838.02s | I was amazed. 838.02s - 841.02s | Okay, this is when the password was last changed. 841.06s - 844.58s | That was in 2002, I guess, right? 844.58s - 846.94s | This is, the basic security hygiene is important 846.94s - 849.66s | because if you're looking at the attacks happening 849.66s - 851.62s | around the globe, they are not, 851.62s - 853.02s | sometimes they are not even using 853.02s - 855.02s | a sophisticated attack vector. 855.02s - 858.42s | They're just getting in, you know, by brute forcing SSH, 858.42s - 860.06s | brute forcing RDP, or, you know, 860.06s - 861.22s | finding stolen credentials. 861.22s - 863.54s | I mean, these are very, very, very, you know, 863.54s - 866.74s | basic matter of security hygiene. 866.74s - 868.50s | I'm not going to take much more time 868.54s - 871.14s | because once I start talking, then done. 871.14s - 873.86s | Okay, I am going to give back to the panel 873.86s - 876.14s | so that they can share their insights 876.14s - 880.06s | on how even the major organizations are getting breached. 880.06s - 881.14s | Right? 881.14s - 884.46s | Some of them are considered to be impenetrable, right? 884.46s - 888.04s | So I'm going to, you know. 888.04s - 888.92s | Pass it back. 890.16s - 891.00s | You started with me again? 891.00s - 891.92s | Yeah. 891.92s - 893.76s | Okay, I guess starting with me again. 895.24s - 899.00s | So MITRE's got a pretty good example of this. 899.00s - 902.48s | We came out in public


chunk_text:
a sophisticated attack vector. 855.02s - 858.42s | They're just getting in, you know, by brute forcing SSH, 858.42s - 860.06s | brute forcing RDP, or, you know, 860.06s - 861.22s | finding stolen credentials. 861.22s - 863.54s | I mean, these are very, very, very, you know, 863.54s - 866.74s | basic matter of security hygiene. 866.74s - 868.50s | I'm not going to take much more time 868.54s - 871.14s | because once I start talking, then done. 871.14s - 873.86s | Okay, I am going to give back to the panel 873.86s - 876.14s | so that they can share their insights 876.14s - 880.06s | on how even the major organizations are getting breached. 880.06s - 881.14s | Right? 881.14s - 884.46s | Some of them are considered to be impenetrable, right? 884.46s - 888.04s | So I'm going to, you know. 888.04s - 888.92s | Pass it back. 890.16s - 891.00s | You started with me again? 891.00s - 891.92s | Yeah. 891.92s - 893.76s | Okay, I guess starting with me again. 895.24s - 899.00s | So MITRE's got a pretty good example of this. 899.00s - 902.48s | We came out in public a matter of months ago 902.48s - 907.48s | that we had had a breach into a lab network at MITRE. 907.80s - 911.36s | And so, you know, adversary had used a couple of zero days 911.36s - 912.76s | against a security appliance, 912.76s - 915.88s | had gotten into the ESX infrastructure 915.88s - 918.36s | that was within that lab. 918.36s - 922.00s | And so, you know, we try pretty hard at security, 922.00s - 925.64s | but, you know, there, we patched as fast 925.64s - 927.04s | as the patches were available. 927.04s - 929.72s | We watched the stuff as well as we could, 929.72s - 931.64s | but they were getting into places 931.64s - 935.00s | that just hadn't necessarily been seen yet, 935.00s - 939.56s | or, you know, just a couple days ahead of the zero days. 939.56s - 941.44s | And so, you know, I'd like to suggest, 941.44s - 944.12s | and I know some people in sort of software hardening 944.12s - 945.56s | might get mad at me for this, 945.56s - 948.76s | but that if an adversary is willing 948.76s - 951.52s


chunk_text:
a matter of months ago 902.48s - 907.48s | that we had had a breach into a lab network at MITRE. 907.80s - 911.36s | And so, you know, adversary had used a couple of zero days 911.36s - 912.76s | against a security appliance, 912.76s - 915.88s | had gotten into the ESX infrastructure 915.88s - 918.36s | that was within that lab. 918.36s - 922.00s | And so, you know, we try pretty hard at security, 922.00s - 925.64s | but, you know, there, we patched as fast 925.64s - 927.04s | as the patches were available. 927.04s - 929.72s | We watched the stuff as well as we could, 929.72s - 931.64s | but they were getting into places 931.64s - 935.00s | that just hadn't necessarily been seen yet, 935.00s - 939.56s | or, you know, just a couple days ahead of the zero days. 939.56s - 941.44s | And so, you know, I'd like to suggest, 941.44s - 944.12s | and I know some people in sort of software hardening 944.12s - 945.56s | might get mad at me for this, 945.56s - 948.76s | but that if an adversary is willing 948.76s - 951.52s | to dedicate enough resources to it, 951.52s - 954.24s | they are going to get into their target. 954.24s - 956.92s | You know, if it doesn't work 956.92s - 959.36s | through some sort of connected means, 959.36s - 961.48s | you always have close access operations, 961.48s - 965.72s | you can, you know, send somebody to the environment. 965.72s - 967.72s | And so it's, you know, one of the reasons 967.72s - 971.16s | that even organizations that are getting a lot right 971.16s - 974.24s | are still having problems is that, you know, 974.24s - 977.52s | we do have places that are willing to escalate 977.52s - 980.40s | right up until they succeed. 980.40s - 982.32s | And so as long as that's going on, 982.32s - 983.72s | as long as we have people sort of willing 983.72s - 984.88s | to dedicate resources, 984.88s - 988.04s | and as long as you're a juicy enough target, 988.04s - 990.36s | you know, it is, you're going to have to sort of 990.36s - 994.28s | deal with containment, deal with being able to detect it, 994.28s - 996.04s |


chunk_text:
| to dedicate enough resources to it, 951.52s - 954.24s | they are going to get into their target. 954.24s - 956.92s | You know, if it doesn't work 956.92s - 959.36s | through some sort of connected means, 959.36s - 961.48s | you always have close access operations, 961.48s - 965.72s | you can, you know, send somebody to the environment. 965.72s - 967.72s | And so it's, you know, one of the reasons 967.72s - 971.16s | that even organizations that are getting a lot right 971.16s - 974.24s | are still having problems is that, you know, 974.24s - 977.52s | we do have places that are willing to escalate 977.52s - 980.40s | right up until they succeed. 980.40s - 982.32s | And so as long as that's going on, 982.32s - 983.72s | as long as we have people sort of willing 983.72s - 984.88s | to dedicate resources, 984.88s - 988.04s | and as long as you're a juicy enough target, 988.04s - 990.36s | you know, it is, you're going to have to sort of 990.36s - 994.28s | deal with containment, deal with being able to detect it, 994.28s - 996.04s | deal with the fallout, 996.04s - 999.76s | rather than just assuming that you can keep them out. 999.76s - 1003.52s | We also just have so many interconnected complex systems. 1003.52s - 1008.00s | And so cloud has definitely made this harder 1008.00s - 1010.92s | where we have new systems that can get, 1010.96s - 1014.72s | adversaries can get into more challenging visibility 1014.72s - 1017.08s | in being able to monitor those systems 1017.08s - 1019.72s | and just creating a bigger surface now 1019.72s - 1026.79s | that people have access to. 1026.79s - 1029.67s | That's very similar to what we've been observing 1029.67s - 1033.55s | on our level, which I can't disclose who our clients are, 1033.55s - 1037.63s | but we see, we're certainly not protecting the NSA yet. 1039.19s - 1042.91s | That said, a lot of the attacks 1042.91s - 1045.11s | that we've been seeing are opportunistic. 1045.11s - 1047.47s | So to the point of basic security hygiene, 1047.47s - 1050.07s | you don't need a pen test to know that you need 1050.07s - 1052.79s | to get business buy-in to get MFA enabled, right? 1054.99s


chunk_text:
deal with the fallout, 996.04s - 999.76s | rather than just assuming that you can keep them out. 999.76s - 1003.52s | We also just have so many interconnected complex systems. 1003.52s - 1008.00s | And so cloud has definitely made this harder 1008.00s - 1010.92s | where we have new systems that can get, 1010.96s - 1014.72s | adversaries can get into more challenging visibility 1014.72s - 1017.08s | in being able to monitor those systems 1017.08s - 1019.72s | and just creating a bigger surface now 1019.72s - 1026.79s | that people have access to. 1026.79s - 1029.67s | That's very similar to what we've been observing 1029.67s - 1033.55s | on our level, which I can't disclose who our clients are, 1033.55s - 1037.63s | but we see, we're certainly not protecting the NSA yet. 1039.19s - 1042.91s | That said, a lot of the attacks 1042.91s - 1045.11s | that we've been seeing are opportunistic. 1045.11s - 1047.47s | So to the point of basic security hygiene, 1047.47s - 1050.07s | you don't need a pen test to know that you need 1050.07s - 1052.79s | to get business buy-in to get MFA enabled, right? 1054.99s - 1059.31s | It's the trick of convincing them that this is worth doing. 1059.31s - 1062.39s | And to that, I can add a couple of stories. 1062.39s - 1065.11s | For example, about one out of every four 1065.11s - 1068.75s | or one out of every five of the people that we onboard 1068.75s - 1072.91s | at our MDR are in the middle of an active BEC, 1072.91s - 1074.19s | business email compromise. 1074.19s - 1077.19s | They had no idea that they were compromised. 1077.19s - 1079.87s | We would go in as part of the onboarding process 1079.87s - 1081.35s | and our SOC will get tickets all the time. 1081.35s - 1083.51s | Hey, we're pinging. 1083.51s - 1085.55s | Can you isolate that for us, please? 1085.55s - 1086.39s | Thank you. 1087.35s - 1089.99s | And they got it as a preventative 1089.99s - 1092.39s | without knowing that they were actively infected 1092.39s - 1095.51s | and in some cases for months 1095.51s - 1097.11s | before they were able to detect that. 1097.11s - 1100.71s | And so to reiterate, if they wanna get in, 1100.71s - 1101.55s


chunk_text:
- 1059.31s | It's the trick of convincing them that this is worth doing. 1059.31s - 1062.39s | And to that, I can add a couple of stories. 1062.39s - 1065.11s | For example, about one out of every four 1065.11s - 1068.75s | or one out of every five of the people that we onboard 1068.75s - 1072.91s | at our MDR are in the middle of an active BEC, 1072.91s - 1074.19s | business email compromise. 1074.19s - 1077.19s | They had no idea that they were compromised. 1077.19s - 1079.87s | We would go in as part of the onboarding process 1079.87s - 1081.35s | and our SOC will get tickets all the time. 1081.35s - 1083.51s | Hey, we're pinging. 1083.51s - 1085.55s | Can you isolate that for us, please? 1085.55s - 1086.39s | Thank you. 1087.35s - 1089.99s | And they got it as a preventative 1089.99s - 1092.39s | without knowing that they were actively infected 1092.39s - 1095.51s | and in some cases for months 1095.51s - 1097.11s | before they were able to detect that. 1097.11s - 1100.71s | And so to reiterate, if they wanna get in, 1100.71s - 1101.55s | they're gonna get in. 1101.55s - 1104.67s | And even if you're not a major organization, 1104.67s - 1107.39s | all it takes is one person to get in. 1107.39s - 1109.47s | And I think part of the problem here 1109.47s - 1112.99s | is that we're dealing with people don't like the idea 1112.99s - 1114.55s | of them going into our home. 1115.51s - 1117.67s | Our servers, our environment, our endpoints, 1117.67s - 1119.87s | this is where we live in a digital era, 1119.87s - 1120.99s | especially if you work from home, 1120.99s - 1123.59s | there is something very personal and intimate. 1123.59s - 1126.91s | And thinking about somebody inside your system 1126.91s - 1128.27s | is a little bit like coming home 1128.27s - 1129.47s | and having the door wide open 1129.47s - 1130.79s | and seeing muddy footprints in front of you. 1130.79s - 1131.63s | It terrifies you. 1131.63s - 1134.35s | So you spend bazillions of dollars 1134.35s - 1136.15s | preventing that from ever being seen, 1136.15s - 1138.83s | but the adversaries are sophisticated enough, 1138.83s - 1141.03s | even at a script kiddie


chunk_text:
| they're gonna get in. 1101.55s - 1104.67s | And even if you're not a major organization, 1104.67s - 1107.39s | all it takes is one person to get in. 1107.39s - 1109.47s | And I think part of the problem here 1109.47s - 1112.99s | is that we're dealing with people don't like the idea 1112.99s - 1114.55s | of them going into our home. 1115.51s - 1117.67s | Our servers, our environment, our endpoints, 1117.67s - 1119.87s | this is where we live in a digital era, 1119.87s - 1120.99s | especially if you work from home, 1120.99s - 1123.59s | there is something very personal and intimate. 1123.59s - 1126.91s | And thinking about somebody inside your system 1126.91s - 1128.27s | is a little bit like coming home 1128.27s - 1129.47s | and having the door wide open 1129.47s - 1130.79s | and seeing muddy footprints in front of you. 1130.79s - 1131.63s | It terrifies you. 1131.63s - 1134.35s | So you spend bazillions of dollars 1134.35s - 1136.15s | preventing that from ever being seen, 1136.15s - 1138.83s | but the adversaries are sophisticated enough, 1138.83s - 1141.03s | even at a script kiddie level, 1141.03s - 1145.07s | thanks to trickle down dark web economics, I suppose, 1146.51s - 1149.47s | that they're cleaning up after themselves 1149.47s - 1151.83s | and the door is very carefully locked behind them. 1151.83s - 1153.51s | You cannot tell. 1153.51s - 1158.51s | And so what I would recommend and reiterate 1158.71s - 1160.67s | is that you can spend all of this money 1160.67s - 1164.95s | on every phishing email attention and antivirus and EDR. 1164.95s - 1167.99s | Those are important core technologies 1167.99s - 1169.71s | that you need for both compliance 1169.71s - 1172.19s | and just getting rid of the kind of the base level, 1172.19s - 1174.95s | but don't think that you've stopped everyone. 1174.95s - 1177.79s | We had a supply chain attack actually 1177.79s - 1180.11s | with a critical infrastructure partner. 1180.11s - 1183.11s | It was a supply chain business email compromise 1183.11s - 1185.39s | that I'm thinking of specifically. 1185.39s - 1188.55s | Their partner was compromised, but didn't know it. 1188.55s - 1192.91s | And one of their personnel sent an email that was expected. 1192.91s - 1194.31s | They


chunk_text:
level, 1141.03s - 1145.07s | thanks to trickle down dark web economics, I suppose, 1146.51s - 1149.47s | that they're cleaning up after themselves 1149.47s - 1151.83s | and the door is very carefully locked behind them. 1151.83s - 1153.51s | You cannot tell. 1153.51s - 1158.51s | And so what I would recommend and reiterate 1158.71s - 1160.67s | is that you can spend all of this money 1160.67s - 1164.95s | on every phishing email attention and antivirus and EDR. 1164.95s - 1167.99s | Those are important core technologies 1167.99s - 1169.71s | that you need for both compliance 1169.71s - 1172.19s | and just getting rid of the kind of the base level, 1172.19s - 1174.95s | but don't think that you've stopped everyone. 1174.95s - 1177.79s | We had a supply chain attack actually 1177.79s - 1180.11s | with a critical infrastructure partner. 1180.11s - 1183.11s | It was a supply chain business email compromise 1183.11s - 1185.39s | that I'm thinking of specifically. 1185.39s - 1188.55s | Their partner was compromised, but didn't know it. 1188.55s - 1192.91s | And one of their personnel sent an email that was expected. 1192.91s - 1194.31s | They wrote it all nine 1195.83s - 1200.35s | to our protected critical infrastructure environment 1200.35s - 1202.31s | about a meeting and it had an attachment 1202.31s - 1205.59s | and it wasn't the attachment, the email PDF 1205.59s - 1207.91s | that was actually the vector. 1207.91s - 1210.95s | It was the image file in this signature line, 1211.83s - 1213.23s | which was fricking... 1214.07s - 1215.99s | It was bad. 1215.99s - 1220.47s | It was very naughty of them, but it was just so clever. 1220.47s - 1223.19s | And they had ended up compromising several 1223.19s - 1227.35s | of that other organizations. 1227.35s - 1229.23s | And so these people were sending out 1229.23s - 1232.67s | completely legitimate emails that were actually phishing. 1232.67s - 1237.67s | And we tripped up on attempted NTLM credential theft 1237.87s - 1239.99s | was how we ended up catching it 1239.99s - 1241.83s | because at that point they got in 1241.83s - 1243.03s | and it wasn't even your front door. 1243.83s - 1244.75s | It was somebody else's and it was a complete... 1244.75s - 1246.63s | You would never have guessed this


chunk_text:
wrote it all nine 1195.83s - 1200.35s | to our protected critical infrastructure environment 1200.35s - 1202.31s | about a meeting and it had an attachment 1202.31s - 1205.59s | and it wasn't the attachment, the email PDF 1205.59s - 1207.91s | that was actually the vector. 1207.91s - 1210.95s | It was the image file in this signature line, 1211.83s - 1213.23s | which was fricking... 1214.07s - 1215.99s | It was bad. 1215.99s - 1220.47s | It was very naughty of them, but it was just so clever. 1220.47s - 1223.19s | And they had ended up compromising several 1223.19s - 1227.35s | of that other organizations. 1227.35s - 1229.23s | And so these people were sending out 1229.23s - 1232.67s | completely legitimate emails that were actually phishing. 1232.67s - 1237.67s | And we tripped up on attempted NTLM credential theft 1237.87s - 1239.99s | was how we ended up catching it 1239.99s - 1241.83s | because at that point they got in 1241.83s - 1243.03s | and it wasn't even your front door. 1243.83s - 1244.75s | It was somebody else's and it was a complete... 1244.75s - 1246.63s | You would never have guessed this was a phishing email. 1246.63s - 1249.27s | I still read this and I'm like, is there a typo? 1249.27s - 1253.35s | It was just the image in the email subject line, 1253.35s - 1255.63s | excuse me, signature line. 1255.63s - 1262.28s | So just food for thought. 1262.28s - 1264.88s | At this scale of our organization, 1264.88s - 1267.16s | the size of the United States government, 1267.16s - 1270.36s | there is no version where they're doing 1270.36s - 1272.64s | all the security by themselves, 1272.64s - 1275.12s | where they're going to rely on 1275.12s - 1276.44s | private industry vendors. 1276.44s - 1281.24s | There's no version where that's remotely conceivable 1281.24s - 1285.27s | to replace private industry. 1285.27s - 1288.31s | At what point do you draw the distinction 1288.31s - 1290.67s | of how you trust a company? 1290.67s - 1295.31s | How far do you dig to find out if they have some, 1296.67s - 1300.03s | at worst, a vulnerability they know but don't disclose 1300.99s - 1306.59s | or willfully ignorant and something popped? 1306.59s - 1309.87s | The hardest part isn't whether or not we


chunk_text:
was a phishing email. 1246.63s - 1249.27s | I still read this and I'm like, is there a typo? 1249.27s - 1253.35s | It was just the image in the email subject line, 1253.35s - 1255.63s | excuse me, signature line. 1255.63s - 1262.28s | So just food for thought. 1262.28s - 1264.88s | At this scale of our organization, 1264.88s - 1267.16s | the size of the United States government, 1267.16s - 1270.36s | there is no version where they're doing 1270.36s - 1272.64s | all the security by themselves, 1272.64s - 1275.12s | where they're going to rely on 1275.12s - 1276.44s | private industry vendors. 1276.44s - 1281.24s | There's no version where that's remotely conceivable 1281.24s - 1285.27s | to replace private industry. 1285.27s - 1288.31s | At what point do you draw the distinction 1288.31s - 1290.67s | of how you trust a company? 1290.67s - 1295.31s | How far do you dig to find out if they have some, 1296.67s - 1300.03s | at worst, a vulnerability they know but don't disclose 1300.99s - 1306.59s | or willfully ignorant and something popped? 1306.59s - 1309.87s | The hardest part isn't whether or not we have to 1309.87s - 1312.59s | or are willing to rely on these vendors. 1312.59s - 1314.87s | Without that level of trust, 1314.87s - 1317.83s | we can't also move this industry forward. 1317.83s - 1320.11s | We all have jobs for this very reason. 1321.07s - 1325.11s | And at what point can we start forgiving 1326.39s - 1328.83s | ways to disclose information that's highly critical 1328.83s - 1330.51s | but also tightly held? 1330.51s - 1334.07s | What's the difference between a zero day to hit MITRE 1334.07s - 1336.23s | or a zero day that hits the White House? 1336.87s - 1340.31s | Why is one more valuable than the other? 1340.31s - 1341.15s | Thank you. 1342.27s - 1345.03s | I would like to add on the same thing 1345.03s - 1347.31s | on the supply chain stuff. 1347.31s - 1352.31s | So that is what a lot of us call gentrification of security, 1353.59s - 1355.43s | hiding stuff behind licenses. 1355.43s - 1357.27s | You know, you get, you pay more. 1357.27s - 1359.67s | If you want to be secure, you pay more out of that. 1359.67s - 1363.71s | So


chunk_text:
have to 1309.87s - 1312.59s | or are willing to rely on these vendors. 1312.59s - 1314.87s | Without that level of trust, 1314.87s - 1317.83s | we can't also move this industry forward. 1317.83s - 1320.11s | We all have jobs for this very reason. 1321.07s - 1325.11s | And at what point can we start forgiving 1326.39s - 1328.83s | ways to disclose information that's highly critical 1328.83s - 1330.51s | but also tightly held? 1330.51s - 1334.07s | What's the difference between a zero day to hit MITRE 1334.07s - 1336.23s | or a zero day that hits the White House? 1336.87s - 1340.31s | Why is one more valuable than the other? 1340.31s - 1341.15s | Thank you. 1342.27s - 1345.03s | I would like to add on the same thing 1345.03s - 1347.31s | on the supply chain stuff. 1347.31s - 1352.31s | So that is what a lot of us call gentrification of security, 1353.59s - 1355.43s | hiding stuff behind licenses. 1355.43s - 1357.27s | You know, you get, you pay more. 1357.27s - 1359.67s | If you want to be secure, you pay more out of that. 1359.67s - 1363.71s | So for example, if you are an organization who has, 1363.71s - 1366.91s | let's say their voice support outsource to Philippines, 1367.27s - 1369.15s | your tech support to India and so on, 1370.03s - 1373.75s | are you sure that the kind of security that your HQ 1373.75s - 1375.87s | or your main office would have, 1375.87s - 1378.75s | is that the same thing that your partners have? 1378.75s - 1381.99s | And I can tell you that coming from a poor country 1381.99s - 1382.95s | that is still developing, 1382.95s - 1384.95s | I can tell you that no, that's not the case. 1384.95s - 1386.55s | Having worked from people right away 1386.55s - 1388.23s | from the easternmost part of the world 1388.23s - 1389.67s | to the westernmost part, 1389.67s - 1393.27s | that is something that always stand out. 1393.27s - 1396.35s | An organization based out of, you know, 1396.79s - 1397.71s | we call it the western world, 1397.71s - 1400.03s | you call it the richer part of the world, 1400.03s - 1403.23s | the kind of security features and the money 1403.23s - 1406.39s | that they


chunk_text:
for example, if you are an organization who has, 1363.71s - 1366.91s | let's say their voice support outsource to Philippines, 1367.27s - 1369.15s | your tech support to India and so on, 1370.03s - 1373.75s | are you sure that the kind of security that your HQ 1373.75s - 1375.87s | or your main office would have, 1375.87s - 1378.75s | is that the same thing that your partners have? 1378.75s - 1381.99s | And I can tell you that coming from a poor country 1381.99s - 1382.95s | that is still developing, 1382.95s - 1384.95s | I can tell you that no, that's not the case. 1384.95s - 1386.55s | Having worked from people right away 1386.55s - 1388.23s | from the easternmost part of the world 1388.23s - 1389.67s | to the westernmost part, 1389.67s - 1393.27s | that is something that always stand out. 1393.27s - 1396.35s | An organization based out of, you know, 1396.79s - 1397.71s | we call it the western world, 1397.71s - 1400.03s | you call it the richer part of the world, 1400.03s - 1403.23s | the kind of security features and the money 1403.23s - 1406.39s | that they would have, even if it is the same organization, 1406.39s - 1409.63s | is going to be entirely different across geographies. 1409.63s - 1412.95s | And however, there is an internal trust that, 1412.95s - 1414.67s | okay, this is my US office 1414.67s - 1416.11s | and that is the same organizations, 1416.11s - 1417.47s | let's say Bangalore office. 1417.47s - 1419.23s | So we trust those guys. 1419.23s - 1422.47s | However, the level of security controls the money 1422.47s - 1424.91s | that is spent there, that is entirely different. 1424.91s - 1427.19s | So that is a sort of a supply chain attack 1427.19s - 1429.59s | that goes under the radar. 1429.59s - 1433.71s | You look at your partners, but not your own offices, 1433.71s - 1435.75s | if you're a large enough organization. 1435.75s - 1437.63s | And if you are a small organization 1437.63s - 1441.91s | that unfortunately not everyone is interested to talk about, 1441.91s - 1444.23s | where you would have an organization of a thousand people 1444.23s - 1445.71s | and a couple of IT guys, 1445.71s - 1449.43s | no, of course, dedicated threat team, then


chunk_text:
would have, even if it is the same organization, 1406.39s - 1409.63s | is going to be entirely different across geographies. 1409.63s - 1412.95s | And however, there is an internal trust that, 1412.95s - 1414.67s | okay, this is my US office 1414.67s - 1416.11s | and that is the same organizations, 1416.11s - 1417.47s | let's say Bangalore office. 1417.47s - 1419.23s | So we trust those guys. 1419.23s - 1422.47s | However, the level of security controls the money 1422.47s - 1424.91s | that is spent there, that is entirely different. 1424.91s - 1427.19s | So that is a sort of a supply chain attack 1427.19s - 1429.59s | that goes under the radar. 1429.59s - 1433.71s | You look at your partners, but not your own offices, 1433.71s - 1435.75s | if you're a large enough organization. 1435.75s - 1437.63s | And if you are a small organization 1437.63s - 1441.91s | that unfortunately not everyone is interested to talk about, 1441.91s - 1444.23s | where you would have an organization of a thousand people 1444.23s - 1445.71s | and a couple of IT guys, 1445.71s - 1449.43s | no, of course, dedicated threat team, then best of luck. 1449.43s - 1453.03s | No one is interested in talking about you at that time. 1453.03s - 1456.35s | So for them, I would say, pick up the open source, 1456.35s - 1461.19s | much hated tools, the OSTs that people create on weekends, 1461.19s - 1463.47s | on their own time, pick them up, 1463.47s - 1466.91s | run it on your own in your environments 1466.91s - 1468.55s | and create your own IOCs. 1468.55s - 1471.79s | If you're a small enough organization, no one cares. 1471.79s - 1476.67s | You have to take care of yourself. 1476.67s - 1481.67s | So I used to share a story about my school days, 1482.35s - 1483.87s | shamelessly everywhere. 1484.67s - 1487.39s | That's about I being bullied in the school. 1487.39s - 1489.19s | So when I was in the lower primary school, 1489.19s - 1490.91s | I was not this big. 1490.91s - 1492.59s | I didn't have a mustache. 1492.59s - 1494.99s | I was a very small, very lean guy, right? 1494.99s - 1497.31s | So other people, they used to bully me a lot. 1497.31s - 1500.43s | Then my


chunk_text:
best of luck. 1449.43s - 1453.03s | No one is interested in talking about you at that time. 1453.03s - 1456.35s | So for them, I would say, pick up the open source, 1456.35s - 1461.19s | much hated tools, the OSTs that people create on weekends, 1461.19s - 1463.47s | on their own time, pick them up, 1463.47s - 1466.91s | run it on your own in your environments 1466.91s - 1468.55s | and create your own IOCs. 1468.55s - 1471.79s | If you're a small enough organization, no one cares. 1471.79s - 1476.67s | You have to take care of yourself. 1476.67s - 1481.67s | So I used to share a story about my school days, 1482.35s - 1483.87s | shamelessly everywhere. 1484.67s - 1487.39s | That's about I being bullied in the school. 1487.39s - 1489.19s | So when I was in the lower primary school, 1489.19s - 1490.91s | I was not this big. 1490.91s - 1492.59s | I didn't have a mustache. 1492.59s - 1494.99s | I was a very small, very lean guy, right? 1494.99s - 1497.31s | So other people, they used to bully me a lot. 1497.31s - 1500.43s | Then my mother, she got me into a karate school. 1500.43s - 1504.27s | Then after a couple of years, I became a bit taller. 1504.27s - 1506.59s | Then eventually I became kind of the bully 1506.59s - 1508.27s | in my high school days. 1508.27s - 1510.51s | So here we have been talking about 1510.51s - 1512.87s | how we have been bullied so far. 1512.87s - 1516.07s | All these organizations are getting bullied, right? 1516.07s - 1521.07s | And now it is a time to learn from the wise people here, 1521.35s - 1523.83s | how we can respond to such attacks. 1523.83s - 1525.15s | So we have seen that, 1526.67s - 1529.31s | so we have seen that all of these organizations 1529.31s - 1532.95s | can be bullied, even using a small technique, 1532.95s - 1536.19s | maybe to the, like, you know, Adam's apple, 1536.19s - 1537.47s | very small technique, right? 1537.47s - 1539.87s | Maybe you can try talking to your friends, right? 1539.87s - 1542.03s | So we have seen that all these organizations 1542.03s - 1543.55s | can be bullied. 1543.55s - 1548.11s | Now, back to them, how


chunk_text:
mother, she got me into a karate school. 1500.43s - 1504.27s | Then after a couple of years, I became a bit taller. 1504.27s - 1506.59s | Then eventually I became kind of the bully 1506.59s - 1508.27s | in my high school days. 1508.27s - 1510.51s | So here we have been talking about 1510.51s - 1512.87s | how we have been bullied so far. 1512.87s - 1516.07s | All these organizations are getting bullied, right? 1516.07s - 1521.07s | And now it is a time to learn from the wise people here, 1521.35s - 1523.83s | how we can respond to such attacks. 1523.83s - 1525.15s | So we have seen that, 1526.67s - 1529.31s | so we have seen that all of these organizations 1529.31s - 1532.95s | can be bullied, even using a small technique, 1532.95s - 1536.19s | maybe to the, like, you know, Adam's apple, 1536.19s - 1537.47s | very small technique, right? 1537.47s - 1539.87s | Maybe you can try talking to your friends, right? 1539.87s - 1542.03s | So we have seen that all these organizations 1542.03s - 1543.55s | can be bullied. 1543.55s - 1548.11s | Now, back to them, how we can respond to these attacks. 1548.11s - 1550.71s | How can we respond to these incidents 1550.71s - 1554.11s | in a better way that we could handle things, right? 1554.99s - 1560.90s | Back at you. 1560.90s - 1562.70s | So I think people might be expecting for me 1562.70s - 1565.22s | to say use MITRE ATT&CK. 1565.22s - 1569.42s | And that's not where you want to start. 1569.42s - 1572.90s | I mean, and so a couple of people have mentioned hygiene 1572.90s - 1574.34s | along the way. 1574.34s - 1578.50s | And, you know, it sounds so basic, 1578.50s - 1581.06s | but making sure that you're getting the basics right first, 1581.06s - 1584.06s | you know, things like multi-factor authentication, 1584.06s - 1585.90s | segmentation of privileges, 1585.90s - 1589.06s | making sure that your network isn't just a flat space 1589.06s - 1591.78s | that an adversary can dance around, 1591.78s - 1594.26s | actually patching your systems. 1594.26s - 1597.22s | And so, you know, working your way up through, 1597.22s - 1598.70s | starting to look at behaviors, 1598.70s - 1601.26s | looking at what people are doing


chunk_text:
we can respond to these attacks. 1548.11s - 1550.71s | How can we respond to these incidents 1550.71s - 1554.11s | in a better way that we could handle things, right? 1554.99s - 1560.90s | Back at you. 1560.90s - 1562.70s | So I think people might be expecting for me 1562.70s - 1565.22s | to say use MITRE ATT&CK. 1565.22s - 1569.42s | And that's not where you want to start. 1569.42s - 1572.90s | I mean, and so a couple of people have mentioned hygiene 1572.90s - 1574.34s | along the way. 1574.34s - 1578.50s | And, you know, it sounds so basic, 1578.50s - 1581.06s | but making sure that you're getting the basics right first, 1581.06s - 1584.06s | you know, things like multi-factor authentication, 1584.06s - 1585.90s | segmentation of privileges, 1585.90s - 1589.06s | making sure that your network isn't just a flat space 1589.06s - 1591.78s | that an adversary can dance around, 1591.78s - 1594.26s | actually patching your systems. 1594.26s - 1597.22s | And so, you know, working your way up through, 1597.22s - 1598.70s | starting to look at behaviors, 1598.70s - 1601.26s | looking at what people are doing in systems, 1601.30s - 1604.90s | sort of more the ATT&CK end of things 1604.90s - 1607.86s | where people are using EDRs and whatnot. 1607.86s - 1611.94s | But I'm a huge fan if you've got your act together 1611.94s - 1613.38s | on all of those things. 1613.38s - 1614.98s | And, you know, talking a little bit about 1614.98s - 1617.78s | how do we bring it back to the adversary. 1617.78s - 1621.30s | I'm a big fan of direct adversary engagement. 1621.30s - 1623.50s | So honeypots, deception, 1623.50s - 1626.22s | actually placing adversaries in environments 1626.22s - 1628.06s | where you're able to monitor them 1628.06s - 1630.62s | potentially for long periods of time 1630.66s - 1632.26s | for a couple of different purposes. 1632.26s - 1635.82s | One is starting to understand what an adversary might do 1635.82s - 1638.38s | when they think that they've broken into your environment. 1638.38s - 1641.34s | If you've really got things going well 1641.34s - 1643.22s | and you're able to get somebody to operate, 1643.22s - 1646.50s | being able to see what exactly those things would be 1646.50s - 1650.18s |


chunk_text:
in systems, 1601.30s - 1604.90s | sort of more the ATT&CK end of things 1604.90s - 1607.86s | where people are using EDRs and whatnot. 1607.86s - 1611.94s | But I'm a huge fan if you've got your act together 1611.94s - 1613.38s | on all of those things. 1613.38s - 1614.98s | And, you know, talking a little bit about 1614.98s - 1617.78s | how do we bring it back to the adversary. 1617.78s - 1621.30s | I'm a big fan of direct adversary engagement. 1621.30s - 1623.50s | So honeypots, deception, 1623.50s - 1626.22s | actually placing adversaries in environments 1626.22s - 1628.06s | where you're able to monitor them 1628.06s - 1630.62s | potentially for long periods of time 1630.66s - 1632.26s | for a couple of different purposes. 1632.26s - 1635.82s | One is starting to understand what an adversary might do 1635.82s - 1638.38s | when they think that they've broken into your environment. 1638.38s - 1641.34s | If you've really got things going well 1641.34s - 1643.22s | and you're able to get somebody to operate, 1643.22s - 1646.50s | being able to see what exactly those things would be 1646.50s - 1650.18s | that you might find out that they have ready for you. 1650.18s - 1651.86s | The other thing is deterrence though. 1651.86s - 1655.34s | So I've had some experience with getting caught 1655.34s - 1657.90s | doing that by adversaries too. 1657.90s - 1661.94s | And what we saw was that they were much more cautious 1661.94s - 1664.14s | in how they operated in the future. 1664.14s - 1666.14s | And so they realized that they had been caught. 1666.14s - 1669.02s | They realized that they'd given up some of their trade craft 1669.02s - 1670.34s | and we saw them back off. 1670.34s - 1672.58s | We saw them spend more time doing 1672.58s - 1674.22s | an attack we'd call discovery. 1674.22s - 1676.78s | So figuring out, am I in the right place? 1676.78s - 1678.10s | What's the system I'm on? 1678.10s - 1679.86s | What are the systems around me? 1679.86s - 1682.38s | Which can be really noisy activity 1682.38s - 1684.70s | if you're watching for the right things. 1684.74s - 1687.94s | And so serving as a little bit of deterrence. 1687.94s - 1690.82s | And so once you're


chunk_text:
that you might find out that they have ready for you. 1650.18s - 1651.86s | The other thing is deterrence though. 1651.86s - 1655.34s | So I've had some experience with getting caught 1655.34s - 1657.90s | doing that by adversaries too. 1657.90s - 1661.94s | And what we saw was that they were much more cautious 1661.94s - 1664.14s | in how they operated in the future. 1664.14s - 1666.14s | And so they realized that they had been caught. 1666.14s - 1669.02s | They realized that they'd given up some of their trade craft 1669.02s - 1670.34s | and we saw them back off. 1670.34s - 1672.58s | We saw them spend more time doing 1672.58s - 1674.22s | an attack we'd call discovery. 1674.22s - 1676.78s | So figuring out, am I in the right place? 1676.78s - 1678.10s | What's the system I'm on? 1678.10s - 1679.86s | What are the systems around me? 1679.86s - 1682.38s | Which can be really noisy activity 1682.38s - 1684.70s | if you're watching for the right things. 1684.74s - 1687.94s | And so serving as a little bit of deterrence. 1687.94s - 1690.82s | And so once you're beyond the basics 1690.82s - 1693.50s | and once you're bringing it back to the adversary, 1693.50s - 1697.06s | if you really have all those things working together, 1697.06s - 1699.18s | I'm a fan of taking it one step farther 1699.18s - 1705.98s | and starting to interact with them a bit. 1705.98s - 1710.98s | I will start with MFA, please. 1711.26s - 1712.98s | Please, just MFA. 1714.78s - 1717.82s | That's my security hygiene pitch right there for today. 1718.58s - 1721.10s | But okay, so let me build on that then. 1721.10s - 1723.14s | Why do more organizations not have MFA? 1723.14s - 1724.90s | Why do more organizations not have 1724.90s - 1726.10s | these basic security protocols? 1726.10s - 1729.06s | One, we're overworked and tired and under-resourced. 1729.06s - 1730.74s | Just straight out, right? 1730.74s - 1735.38s | Second reason, people see security 1735.38s - 1738.26s | not as an insurance policy, but as a cost center. 1738.26s - 1739.62s | And by people, I mean finance 1739.62s - 1742.18s | and I mean the executives who control the budget. 1742.18s - 1744.78s | They aren't here right now,


chunk_text:
beyond the basics 1690.82s - 1693.50s | and once you're bringing it back to the adversary, 1693.50s - 1697.06s | if you really have all those things working together, 1697.06s - 1699.18s | I'm a fan of taking it one step farther 1699.18s - 1705.98s | and starting to interact with them a bit. 1705.98s - 1710.98s | I will start with MFA, please. 1711.26s - 1712.98s | Please, just MFA. 1714.78s - 1717.82s | That's my security hygiene pitch right there for today. 1718.58s - 1721.10s | But okay, so let me build on that then. 1721.10s - 1723.14s | Why do more organizations not have MFA? 1723.14s - 1724.90s | Why do more organizations not have 1724.90s - 1726.10s | these basic security protocols? 1726.10s - 1729.06s | One, we're overworked and tired and under-resourced. 1729.06s - 1730.74s | Just straight out, right? 1730.74s - 1735.38s | Second reason, people see security 1735.38s - 1738.26s | not as an insurance policy, but as a cost center. 1738.26s - 1739.62s | And by people, I mean finance 1739.62s - 1742.18s | and I mean the executives who control the budget. 1742.18s - 1744.78s | They aren't here right now, you are. 1744.78s - 1748.74s | You are the advocate for every user in your organization. 1749.58s - 1751.62s | You wanna know how you use sophisticated 1751.62s - 1754.58s | nation state attacks at your organization 1754.58s - 1755.98s | regardless of the size? 1755.98s - 1758.50s | You use it as an example. 1758.50s - 1760.34s | Executives and people with finance 1760.34s - 1763.18s | actually understand headlines, right? 1763.18s - 1765.46s | Find ones that are similar to yours 1765.46s - 1769.50s | and say, look, this costs millions scaled down. 1769.50s - 1772.42s | This could cost us this amount. 1772.42s - 1774.82s | And of course, do your ALE calculation, 1774.82s - 1777.34s | percentage of probability of something attacking 1777.34s - 1779.54s | times the cost of the impact. 1779.54s - 1781.70s | Remember your soft costs, your knock-on costs, 1781.70s - 1785.38s | your lost contracts and time and reputation. 1785.38s - 1787.42s | Those are all in addition to whatever 1787.42s - 1791.18s | your insurance premium is going to go up by, right? 1791.18s - 1793.30s | Present that then, and then go to them and say, 1793.30s - 1796.18s


chunk_text:
you are. 1744.78s - 1748.74s | You are the advocate for every user in your organization. 1749.58s - 1751.62s | You wanna know how you use sophisticated 1751.62s - 1754.58s | nation state attacks at your organization 1754.58s - 1755.98s | regardless of the size? 1755.98s - 1758.50s | You use it as an example. 1758.50s - 1760.34s | Executives and people with finance 1760.34s - 1763.18s | actually understand headlines, right? 1763.18s - 1765.46s | Find ones that are similar to yours 1765.46s - 1769.50s | and say, look, this costs millions scaled down. 1769.50s - 1772.42s | This could cost us this amount. 1772.42s - 1774.82s | And of course, do your ALE calculation, 1774.82s - 1777.34s | percentage of probability of something attacking 1777.34s - 1779.54s | times the cost of the impact. 1779.54s - 1781.70s | Remember your soft costs, your knock-on costs, 1781.70s - 1785.38s | your lost contracts and time and reputation. 1785.38s - 1787.42s | Those are all in addition to whatever 1787.42s - 1791.18s | your insurance premium is going to go up by, right? 1791.18s - 1793.30s | Present that then, and then go to them and say, 1793.30s - 1796.18s | if we enable MFA, it costs like nothing. 1797.70s - 1799.98s | And your executives who will be on the line 1799.98s - 1804.06s | and talking to the press when an attack happens 1804.06s - 1806.34s | and you have paper trailed 1807.38s - 1811.38s | everything of your recommendation, you will be fine. 1811.38s - 1812.50s | The organization ultimately, 1812.50s - 1815.78s | unless you are in critical infrastructure and healthcare, 1815.78s - 1817.22s | data is at risk. 1817.22s - 1818.90s | The company is at risk. 1818.90s - 1821.14s | Livelihoods are at risks, but not lives. 1821.14s - 1824.26s | You will be fine. 1824.26s - 1826.38s | The executives know that they're on the line. 1826.38s - 1828.34s | Bring it home to them and talk to them 1828.34s - 1829.94s | in the language that they most understand 1829.94s - 1832.18s | because it's easy for us to sit up here, right? 1832.18s - 1835.62s | And say, yeah, easy peasy. 1835.62s - 1837.14s | We know the solution already 1837.14s - 1839.78s | for a lot of these nation state attacks, 1839.78s - 1842.58s | but when boots on the


chunk_text:
| if we enable MFA, it costs like nothing. 1797.70s - 1799.98s | And your executives who will be on the line 1799.98s - 1804.06s | and talking to the press when an attack happens 1804.06s - 1806.34s | and you have paper trailed 1807.38s - 1811.38s | everything of your recommendation, you will be fine. 1811.38s - 1812.50s | The organization ultimately, 1812.50s - 1815.78s | unless you are in critical infrastructure and healthcare, 1815.78s - 1817.22s | data is at risk. 1817.22s - 1818.90s | The company is at risk. 1818.90s - 1821.14s | Livelihoods are at risks, but not lives. 1821.14s - 1824.26s | You will be fine. 1824.26s - 1826.38s | The executives know that they're on the line. 1826.38s - 1828.34s | Bring it home to them and talk to them 1828.34s - 1829.94s | in the language that they most understand 1829.94s - 1832.18s | because it's easy for us to sit up here, right? 1832.18s - 1835.62s | And say, yeah, easy peasy. 1835.62s - 1837.14s | We know the solution already 1837.14s - 1839.78s | for a lot of these nation state attacks, 1839.78s - 1842.58s | but when boots on the ground, we're not there with you. 1842.58s - 1844.78s | When you're trying to illustrate to them, 1844.78s - 1847.86s | you're all fired up from DEF CON, from Hacker Summer Camp, 1847.86s - 1849.98s | and you're trying to justify this expenditure 1849.98s - 1852.98s | to those people, bring it back to the money 1853.86s - 1856.10s | and then demonstrate how this is 1856.10s - 1858.34s | perhaps a minor inconvenience, 1858.34s - 1861.22s | but it's so much better than the alternative. 1861.22s - 1865.58s | And you have all of the stories here at this conference 1865.58s - 1871.02s | to fuel that for your next budget. 1871.02s - 1873.42s | The thing to consider is psychology. 1875.10s - 1878.30s | You have to ask yourself, 1878.30s - 1883.30s | not who or how you get attacked, but why. 1884.74s - 1886.14s | What is the motivation? 1886.14s - 1889.06s | And that motivation direct influence 1889.06s - 1891.50s | to how the attack is carried out. 1891.50s - 1894.26s | Because there is high value to attacks 1894.26s - 1896.78s | that are very noisy and very obvious 1896.78s - 1898.58s | that winds


chunk_text:
ground, we're not there with you. 1842.58s - 1844.78s | When you're trying to illustrate to them, 1844.78s - 1847.86s | you're all fired up from DEF CON, from Hacker Summer Camp, 1847.86s - 1849.98s | and you're trying to justify this expenditure 1849.98s - 1852.98s | to those people, bring it back to the money 1853.86s - 1856.10s | and then demonstrate how this is 1856.10s - 1858.34s | perhaps a minor inconvenience, 1858.34s - 1861.22s | but it's so much better than the alternative. 1861.22s - 1865.58s | And you have all of the stories here at this conference 1865.58s - 1871.02s | to fuel that for your next budget. 1871.02s - 1873.42s | The thing to consider is psychology. 1875.10s - 1878.30s | You have to ask yourself, 1878.30s - 1883.30s | not who or how you get attacked, but why. 1884.74s - 1886.14s | What is the motivation? 1886.14s - 1889.06s | And that motivation direct influence 1889.06s - 1891.50s | to how the attack is carried out. 1891.50s - 1894.26s | Because there is high value to attacks 1894.26s - 1896.78s | that are very noisy and very obvious 1896.78s - 1898.58s | that winds up on CNN. 1898.58s - 1901.42s | There's also a lot of value to attacks 1901.42s - 1905.78s | that go unnoticed for days, weeks, months, and years. 1906.78s - 1910.90s | So understanding the persona of your adversary 1910.90s - 1915.06s | is so critical to even have a chance to push back 1915.06s - 1916.86s | to wear that hat for a day 1916.90s - 1919.82s | and really consider beyond what this attack 1919.82s - 1921.74s | or what this person, this human is doing, 1921.74s - 1924.22s | but what's their motivation? 1924.22s - 1925.82s | What's their culture? 1925.82s - 1927.66s | What's their everyday like? 1927.66s - 1930.42s | Why are they even in that seat? 1930.42s - 1933.62s | So think about the fact that the other side, 1933.62s - 1937.22s | there's someone just like you just having a job 1937.22s - 1940.82s | and well, you are it today for the target. 1942.74s - 1944.06s | That is a very good point. 1944.42s - 1947.94s | One tech aspect that I would like to address is, 1949.34s - 1952.78s | when we look at the defense versus offense side, 1954.02s -


chunk_text:
up on CNN. 1898.58s - 1901.42s | There's also a lot of value to attacks 1901.42s - 1905.78s | that go unnoticed for days, weeks, months, and years. 1906.78s - 1910.90s | So understanding the persona of your adversary 1910.90s - 1915.06s | is so critical to even have a chance to push back 1915.06s - 1916.86s | to wear that hat for a day 1916.90s - 1919.82s | and really consider beyond what this attack 1919.82s - 1921.74s | or what this person, this human is doing, 1921.74s - 1924.22s | but what's their motivation? 1924.22s - 1925.82s | What's their culture? 1925.82s - 1927.66s | What's their everyday like? 1927.66s - 1930.42s | Why are they even in that seat? 1930.42s - 1933.62s | So think about the fact that the other side, 1933.62s - 1937.22s | there's someone just like you just having a job 1937.22s - 1940.82s | and well, you are it today for the target. 1942.74s - 1944.06s | That is a very good point. 1944.42s - 1947.94s | One tech aspect that I would like to address is, 1949.34s - 1952.78s | when we look at the defense versus offense side, 1954.02s - 1957.06s | so the skills are not equal. 1957.06s - 1959.26s | So on the offense side, on the red team side, 1959.26s - 1962.90s | you would have tools that are not enterprise grade 1962.90s - 1964.58s | if I use that word. 1964.58s - 1968.06s | So for the attackers, you would have tools 1968.06s - 1970.42s | like still mimic arts and probably something similar 1970.42s - 1973.22s | that was written by someone bored over a weekend 1973.22s - 1974.82s | or just out of interest. 1974.82s - 1976.50s | Whereas if you look at the defense side, 1976.50s - 1978.22s | they have a lot better tools. 1978.22s - 1982.22s | So why is it that it is looked at 1982.22s - 1984.46s | as a failure of blue side? 1984.46s - 1986.06s | It is not the case. 1986.98s - 1989.58s | The only thing that I would like to put in here 1989.58s - 1994.22s | for the defense is we need to improve on what we look at. 1994.22s - 1996.70s | So the parameter-based security is long died. 1996.70s - 1998.62s | Do not look at it that way. 1998.62s -


chunk_text:
1957.06s | so the skills are not equal. 1957.06s - 1959.26s | So on the offense side, on the red team side, 1959.26s - 1962.90s | you would have tools that are not enterprise grade 1962.90s - 1964.58s | if I use that word. 1964.58s - 1968.06s | So for the attackers, you would have tools 1968.06s - 1970.42s | like still mimic arts and probably something similar 1970.42s - 1973.22s | that was written by someone bored over a weekend 1973.22s - 1974.82s | or just out of interest. 1974.82s - 1976.50s | Whereas if you look at the defense side, 1976.50s - 1978.22s | they have a lot better tools. 1978.22s - 1982.22s | So why is it that it is looked at 1982.22s - 1984.46s | as a failure of blue side? 1984.46s - 1986.06s | It is not the case. 1986.98s - 1989.58s | The only thing that I would like to put in here 1989.58s - 1994.22s | for the defense is we need to improve on what we look at. 1994.22s - 1996.70s | So the parameter-based security is long died. 1996.70s - 1998.62s | Do not look at it that way. 1998.62s - 2000.46s | So there are some very good points made by her, 2000.46s - 2003.14s | for example, to let your executives understand 2003.14s - 2005.70s | that even that wasn't eye-opening stuff for me. 2005.70s - 2007.90s | Of course, we need to speak their language. 2007.90s - 2011.38s | But on the tech side, I would say look for identity. 2011.38s - 2014.22s | So if I may use some very tech words, 2014.22s - 2017.10s | you know, like say attacks very specific to Windows, 2017.10s - 2019.94s | credential extraction, overpass the hash, 2019.94s - 2024.94s | replay of tickets, everything is abuse of an identity. 2025.06s - 2026.94s | Do you look at that? 2026.94s - 2028.46s | Can someone steal my credentials? 2028.46s - 2029.78s | Yes, try to stop that. 2029.78s - 2030.62s | It is fine. 2030.62s - 2031.46s | They get it. 2031.46s - 2033.94s | But when they are using those credentials, 2033.94s - 2035.78s | that is where you step in. 2036.62s - 2040.26s | And as you said, you know, you push them back. 2040.26s - 2042.06s | So that needs to be changed. 2042.06s - 2043.14s |


chunk_text:
2000.46s | So there are some very good points made by her, 2000.46s - 2003.14s | for example, to let your executives understand 2003.14s - 2005.70s | that even that wasn't eye-opening stuff for me. 2005.70s - 2007.90s | Of course, we need to speak their language. 2007.90s - 2011.38s | But on the tech side, I would say look for identity. 2011.38s - 2014.22s | So if I may use some very tech words, 2014.22s - 2017.10s | you know, like say attacks very specific to Windows, 2017.10s - 2019.94s | credential extraction, overpass the hash, 2019.94s - 2024.94s | replay of tickets, everything is abuse of an identity. 2025.06s - 2026.94s | Do you look at that? 2026.94s - 2028.46s | Can someone steal my credentials? 2028.46s - 2029.78s | Yes, try to stop that. 2029.78s - 2030.62s | It is fine. 2030.62s - 2031.46s | They get it. 2031.46s - 2033.94s | But when they are using those credentials, 2033.94s - 2035.78s | that is where you step in. 2036.62s - 2040.26s | And as you said, you know, you push them back. 2040.26s - 2042.06s | So that needs to be changed. 2042.06s - 2043.14s | Yes, tools evolve. 2043.14s - 2044.94s | We've got, you know, your CISOs may get, you know, 2044.94s - 2047.02s | new toys from RSA. 2047.02s - 2047.86s | I take names. 2047.86s - 2049.38s | I'm sorry. 2049.38s - 2052.42s | So your CISO may get new toys, let's say from RSA. 2052.42s - 2053.26s | That's fine. 2053.26s - 2054.66s | But look at the identity part. 2054.66s - 2056.78s | That is where everything is. 2056.78s - 2057.70s | It may be hybrid. 2057.70s - 2058.86s | It may be cloud only. 2058.86s - 2060.54s | It may be on-prem only. 2060.54s - 2062.30s | Do not look at the network. 2062.30s - 2064.34s | It is the identity. 2064.34s - 2065.86s | That is, it gets stolen. 2065.86s - 2066.70s | Yes, fine. 2066.70s - 2067.54s | It will. 2067.54s - 2070.34s | But when someone uses that, you step in and stop them. 2070.34s - 2071.66s | That would be my advice. 2072.54s - 2079.80s | I'm going to add a point. 2079.80s - 2081.40s | The mic is not letting me speak. 2082.88s - 2083.72s | Okay. 2083.72s - 2087.52s | I'm going to


chunk_text:
Yes, tools evolve. 2043.14s - 2044.94s | We've got, you know, your CISOs may get, you know, 2044.94s - 2047.02s | new toys from RSA. 2047.02s - 2047.86s | I take names. 2047.86s - 2049.38s | I'm sorry. 2049.38s - 2052.42s | So your CISO may get new toys, let's say from RSA. 2052.42s - 2053.26s | That's fine. 2053.26s - 2054.66s | But look at the identity part. 2054.66s - 2056.78s | That is where everything is. 2056.78s - 2057.70s | It may be hybrid. 2057.70s - 2058.86s | It may be cloud only. 2058.86s - 2060.54s | It may be on-prem only. 2060.54s - 2062.30s | Do not look at the network. 2062.30s - 2064.34s | It is the identity. 2064.34s - 2065.86s | That is, it gets stolen. 2065.86s - 2066.70s | Yes, fine. 2066.70s - 2067.54s | It will. 2067.54s - 2070.34s | But when someone uses that, you step in and stop them. 2070.34s - 2071.66s | That would be my advice. 2072.54s - 2079.80s | I'm going to add a point. 2079.80s - 2081.40s | The mic is not letting me speak. 2082.88s - 2083.72s | Okay. 2083.72s - 2087.52s | I'm going to add a simple point to what Stryker mentioned. 2087.52s - 2089.36s | Like, you know, the small things. 2089.36s - 2091.56s | So there is a, there was an executive. 2092.40s - 2093.24s | Okay. 2093.24s - 2094.24s | There was an executive. 2094.24s - 2096.44s | I think he's still here somewhere. 2096.44s - 2097.28s | I don't know. 2097.28s - 2098.60s | I don't know. 2098.60s - 2101.56s | What he did, he was using MFA 2101.56s - 2106.56s | and he was using Google Chrome in his office laptop 2107.84s - 2111.69s | with his personal email account. 2111.69s - 2114.05s | Everything, all the credentials got synced 2114.05s - 2116.53s | with that Google Chrome email account. 2116.53s - 2118.97s | Then eventually he used the same account outside. 2120.49s - 2121.93s | On a fine morning. 2121.93s - 2122.77s | I don't know. 2123.57s - 2125.37s | The breaches happens on Friday. 2125.37s - 2127.97s | I don't know the logic of that. 2127.97s - 2131.25s | It's only after Friday or during Christmas. 2131.25s - 2133.09s | That's Christmas, New Year Eve, right? 2133.09s - 2134.17s | I don't know how it is. 2134.17s


chunk_text:
add a simple point to what Stryker mentioned. 2087.52s - 2089.36s | Like, you know, the small things. 2089.36s - 2091.56s | So there is a, there was an executive. 2092.40s - 2093.24s | Okay. 2093.24s - 2094.24s | There was an executive. 2094.24s - 2096.44s | I think he's still here somewhere. 2096.44s - 2097.28s | I don't know. 2097.28s - 2098.60s | I don't know. 2098.60s - 2101.56s | What he did, he was using MFA 2101.56s - 2106.56s | and he was using Google Chrome in his office laptop 2107.84s - 2111.69s | with his personal email account. 2111.69s - 2114.05s | Everything, all the credentials got synced 2114.05s - 2116.53s | with that Google Chrome email account. 2116.53s - 2118.97s | Then eventually he used the same account outside. 2120.49s - 2121.93s | On a fine morning. 2121.93s - 2122.77s | I don't know. 2123.57s - 2125.37s | The breaches happens on Friday. 2125.37s - 2127.97s | I don't know the logic of that. 2127.97s - 2131.25s | It's only after Friday or during Christmas. 2131.25s - 2133.09s | That's Christmas, New Year Eve, right? 2133.09s - 2134.17s | I don't know how it is. 2134.17s - 2135.01s | I don't know. 2135.01s - 2137.09s | Maybe that's how it works. 2137.09s - 2139.09s | Then that email got breached. 2139.09s - 2140.97s | Then all the credentials were there. 2140.97s - 2142.57s | Some of them might be having MFA. 2142.57s - 2143.85s | Some of them might not. 2143.85s - 2147.17s | And this guy, he was also using a small extension 2147.17s - 2150.53s | in his browser as a substitute for 2FA. 2151.53s - 2152.77s | I don't know. 2152.77s - 2156.17s | Even after using 2FA, people can actually, 2157.45s - 2159.97s | yeah, mess things up, right? 2160.89s - 2165.57s | And we have like 15 more, I think, like, yeah, 2165.57s - 2166.89s | 17 more minutes. 2166.89s - 2169.05s | I'm going to add something to Nikhil's point as well 2169.05s - 2171.09s | about the defense part. 2171.09s - 2172.77s | So I always tell people, everyone, 2172.77s - 2175.65s | like, you know, the teams actually work for the defense. 2175.65s - 2177.53s | That's where all the money is. 2177.53s - 2179.73s | They have all the fancy tools. 2179.77s - 2180.61s | You need


chunk_text:
- 2135.01s | I don't know. 2135.01s - 2137.09s | Maybe that's how it works. 2137.09s - 2139.09s | Then that email got breached. 2139.09s - 2140.97s | Then all the credentials were there. 2140.97s - 2142.57s | Some of them might be having MFA. 2142.57s - 2143.85s | Some of them might not. 2143.85s - 2147.17s | And this guy, he was also using a small extension 2147.17s - 2150.53s | in his browser as a substitute for 2FA. 2151.53s - 2152.77s | I don't know. 2152.77s - 2156.17s | Even after using 2FA, people can actually, 2157.45s - 2159.97s | yeah, mess things up, right? 2160.89s - 2165.57s | And we have like 15 more, I think, like, yeah, 2165.57s - 2166.89s | 17 more minutes. 2166.89s - 2169.05s | I'm going to add something to Nikhil's point as well 2169.05s - 2171.09s | about the defense part. 2171.09s - 2172.77s | So I always tell people, everyone, 2172.77s - 2175.65s | like, you know, the teams actually work for the defense. 2175.65s - 2177.53s | That's where all the money is. 2177.53s - 2179.73s | They have all the fancy tools. 2179.77s - 2180.61s | You need to work with them. 2180.61s - 2183.05s | You need to work with them very closely to like, you know, 2183.05s - 2185.53s | share or provide more value 2185.53s - 2188.25s | in terms of offensive security assessments, right? 2188.25s - 2191.85s | Then I kind of started doing that in my life as well. 2191.85s - 2194.85s | I kind of, you know, got close with someone in the blue team 2194.85s - 2196.29s | and I had to marry her. 2196.29s - 2200.05s | But then again, I tell people, don't go that far. 2200.05s - 2202.69s | Be friendly with your defense guys. 2202.69s - 2204.97s | Like, you know, share tactics, right? 2204.97s - 2206.53s | Share the detection plans. 2206.53s - 2208.49s | Then don't go that far, right? 2208.49s - 2210.57s | I joke about it all the time, right? 2210.57s - 2213.13s | And going back to the panel, 2213.13s - 2214.77s | because we have like 15 more minutes, 2214.77s - 2216.09s | if they don't have anything to say, 2216.09s - 2217.81s | then we can take questions. 2217.81s - 2218.85s | I will not be answering anything. 2218.85s -


chunk_text:
to work with them. 2180.61s - 2183.05s | You need to work with them very closely to like, you know, 2183.05s - 2185.53s | share or provide more value 2185.53s - 2188.25s | in terms of offensive security assessments, right? 2188.25s - 2191.85s | Then I kind of started doing that in my life as well. 2191.85s - 2194.85s | I kind of, you know, got close with someone in the blue team 2194.85s - 2196.29s | and I had to marry her. 2196.29s - 2200.05s | But then again, I tell people, don't go that far. 2200.05s - 2202.69s | Be friendly with your defense guys. 2202.69s - 2204.97s | Like, you know, share tactics, right? 2204.97s - 2206.53s | Share the detection plans. 2206.53s - 2208.49s | Then don't go that far, right? 2208.49s - 2210.57s | I joke about it all the time, right? 2210.57s - 2213.13s | And going back to the panel, 2213.13s - 2214.77s | because we have like 15 more minutes, 2214.77s - 2216.09s | if they don't have anything to say, 2216.09s - 2217.81s | then we can take questions. 2217.81s - 2218.85s | I will not be answering anything. 2218.85s - 2221.69s | All these four guys will be answering your questions. 2223.49s - 2226.37s | Unless you don't have anything more to say, yeah. 2226.37s - 2227.69s | Yeah, let's see what they want to know. 2227.69s - 2237.74s | Yeah, it's totally up to you, yeah. 2237.74s - 2239.82s | Could someone get him a mic? 2239.82s - 2251.22s | Set, yeah, yeah, yeah. 2251.22s - 2253.26s | It's going to happen every time. 2253.26s - 2257.00s | All right. 2257.00s - 2261.77s | I'm just finding the sweet spot. 2261.77s - 2264.94s | No mic? 2264.94s - 2266.54s | Oh, okay. 2266.54s - 2268.78s | You told a story about the email compromise, right? 2268.78s - 2271.14s | And there was an image on the signature, right? 2271.14s - 2272.58s | Yes. 2272.58s - 2274.50s | I'm trying to wrap my head around it. 2274.50s - 2276.10s | Why would the adversary do that? 2276.10s - 2278.70s | Because it's easy for them to open, 2278.70s - 2280.42s | it's easy for the victim to open the attachment 2280.42s - 2281.82s | rather than the signature. 2281.82s - 2284.78s | I don't remember the last time I clicked


chunk_text:
2221.69s | All these four guys will be answering your questions. 2223.49s - 2226.37s | Unless you don't have anything more to say, yeah. 2226.37s - 2227.69s | Yeah, let's see what they want to know. 2227.69s - 2237.74s | Yeah, it's totally up to you, yeah. 2237.74s - 2239.82s | Could someone get him a mic? 2239.82s - 2251.22s | Set, yeah, yeah, yeah. 2251.22s - 2253.26s | It's going to happen every time. 2253.26s - 2257.00s | All right. 2257.00s - 2261.77s | I'm just finding the sweet spot. 2261.77s - 2264.94s | No mic? 2264.94s - 2266.54s | Oh, okay. 2266.54s - 2268.78s | You told a story about the email compromise, right? 2268.78s - 2271.14s | And there was an image on the signature, right? 2271.14s - 2272.58s | Yes. 2272.58s - 2274.50s | I'm trying to wrap my head around it. 2274.50s - 2276.10s | Why would the adversary do that? 2276.10s - 2278.70s | Because it's easy for them to open, 2278.70s - 2280.42s | it's easy for the victim to open the attachment 2280.42s - 2281.82s | rather than the signature. 2281.82s - 2284.78s | I don't remember the last time I clicked on an email signature. 2284.78s - 2288.18s | So, the question had to do with the explicit 2288.18s - 2290.66s | business email compromise example that I gave. 2291.58s - 2293.62s | So, I'm going to give you a little bit of background 2293.62s - 2295.22s | on what I was talking about earlier. 2295.22s - 2299.30s | Why would an adversary put it into the signature line? 2299.30s - 2300.94s | I actually have a right, 2300.94s - 2304.18s | I believe we presented on this at Black Hat. 2304.18s - 2306.78s | That was one of the three case studies that was picked 2306.78s - 2310.90s | by my VP, Mac, as part of her presentation. 2310.90s - 2313.62s | So, I do have the actual technical information there. 2313.62s - 2316.22s | It is literally just blanking on my head right now. 2316.22s - 2318.66s | I will tell you the motivation for doing something like that 2318.66s - 2321.66s | because if you have correctly targeted, 2321.66s - 2323.74s | speaking of knowing the persona, right? 2323.74s - 2328.74s | If my client was a critical infrastructure client, 2328.78s - 2332.78s | which means that they're


chunk_text:
on an email signature. 2284.78s - 2288.18s | So, the question had to do with the explicit 2288.18s - 2290.66s | business email compromise example that I gave. 2291.58s - 2293.62s | So, I'm going to give you a little bit of background 2293.62s - 2295.22s | on what I was talking about earlier. 2295.22s - 2299.30s | Why would an adversary put it into the signature line? 2299.30s - 2300.94s | I actually have a right, 2300.94s - 2304.18s | I believe we presented on this at Black Hat. 2304.18s - 2306.78s | That was one of the three case studies that was picked 2306.78s - 2310.90s | by my VP, Mac, as part of her presentation. 2310.90s - 2313.62s | So, I do have the actual technical information there. 2313.62s - 2316.22s | It is literally just blanking on my head right now. 2316.22s - 2318.66s | I will tell you the motivation for doing something like that 2318.66s - 2321.66s | because if you have correctly targeted, 2321.66s - 2323.74s | speaking of knowing the persona, right? 2323.74s - 2328.74s | If my client was a critical infrastructure client, 2328.78s - 2332.78s | which means that they're susceptible to nation state attacks 2332.78s - 2334.86s | like that is one of their targets, right? 2334.86s - 2338.66s | If they get in there, they can have all of us, right? 2339.70s - 2343.42s | So, it was worth it to them to investigate the supplier 2343.42s - 2345.22s | and the type of people that they worked with 2345.22s - 2349.38s | and do those months and that research that's required, 2349.38s - 2353.14s | days and weeks and months in order to do that, right? 2353.14s - 2355.74s | So then, to your point earlier, 2355.74s - 2357.38s | you don't want to be noisy at that point, right? 2357.38s - 2360.58s | You want to do something that will escape 2360.58s - 2363.30s | and evade traditional indicators of compromise 2363.30s - 2364.74s | where you're not doing discovery. 2364.74s - 2367.62s | It's a weird APT spray and pray approach, right? 2367.62s - 2370.26s | You're trusting that you did your OSINT correctly, 2370.26s - 2373.82s | your research and your reconnaissance 2373.82s - 2376.74s | that you have in fact infiltrated the correct one, right? 2376.74s - 2379.46s | So, that's the first


chunk_text:
susceptible to nation state attacks 2332.78s - 2334.86s | like that is one of their targets, right? 2334.86s - 2338.66s | If they get in there, they can have all of us, right? 2339.70s - 2343.42s | So, it was worth it to them to investigate the supplier 2343.42s - 2345.22s | and the type of people that they worked with 2345.22s - 2349.38s | and do those months and that research that's required, 2349.38s - 2353.14s | days and weeks and months in order to do that, right? 2353.14s - 2355.74s | So then, to your point earlier, 2355.74s - 2357.38s | you don't want to be noisy at that point, right? 2357.38s - 2360.58s | You want to do something that will escape 2360.58s - 2363.30s | and evade traditional indicators of compromise 2363.30s - 2364.74s | where you're not doing discovery. 2364.74s - 2367.62s | It's a weird APT spray and pray approach, right? 2367.62s - 2370.26s | You're trusting that you did your OSINT correctly, 2370.26s - 2373.82s | your research and your reconnaissance 2373.82s - 2376.74s | that you have in fact infiltrated the correct one, right? 2376.74s - 2379.46s | So, that's the first reason why you would do that supplier. 2379.46s - 2383.86s | The second is you put it in the email signature line 2383.86s - 2387.26s | because why would you write the phishing email for them, 2387.26s - 2388.10s | right? 2388.10s - 2390.34s | It's written by the victim. 2390.34s - 2391.30s | They don't know their... 2391.30s - 2393.54s | How often do you guys go and check your signatures? 2393.54s - 2396.50s | Just out of curiosity, how often do you check 2396.50s - 2399.62s | if somebody's changed your signature in your outlook? 2399.62s - 2400.78s | Are you doing it now? 2401.78s - 2403.62s | Yeah, I haven't looked at mine in a while 2403.62s - 2405.30s | and now I'm suddenly very nervous. 2406.46s - 2408.74s | And so, it's something that... 2408.74s - 2411.06s | It's a space that you don't think to look. 2411.06s - 2412.66s | You don't think to check. 2412.66s - 2414.78s | We're looking for attachments on emails usually. 2414.78s - 2416.54s | We're trying to distrust that. 2417.58s - 2419.86s | The email itself triggered. 2419.86s - 2422.58s | I don't actually recall what the image was.


chunk_text:
reason why you would do that supplier. 2379.46s - 2383.86s | The second is you put it in the email signature line 2383.86s - 2387.26s | because why would you write the phishing email for them, 2387.26s - 2388.10s | right? 2388.10s - 2390.34s | It's written by the victim. 2390.34s - 2391.30s | They don't know their... 2391.30s - 2393.54s | How often do you guys go and check your signatures? 2393.54s - 2396.50s | Just out of curiosity, how often do you check 2396.50s - 2399.62s | if somebody's changed your signature in your outlook? 2399.62s - 2400.78s | Are you doing it now? 2401.78s - 2403.62s | Yeah, I haven't looked at mine in a while 2403.62s - 2405.30s | and now I'm suddenly very nervous. 2406.46s - 2408.74s | And so, it's something that... 2408.74s - 2411.06s | It's a space that you don't think to look. 2411.06s - 2412.66s | You don't think to check. 2412.66s - 2414.78s | We're looking for attachments on emails usually. 2414.78s - 2416.54s | We're trying to distrust that. 2417.58s - 2419.86s | The email itself triggered. 2419.86s - 2422.58s | I don't actually recall what the image was. 2422.58s - 2423.66s | It did require a click. 2423.66s - 2425.42s | This was not clickless as I recall. 2426.26s - 2430.86s | So, something about that image was close enough 2430.86s - 2433.02s | and familiar enough to the person sending the email 2433.02s - 2434.86s | that they didn't question it. 2434.86s - 2437.86s | It led to an attempted sign-in, 2437.86s - 2441.54s | which was rather clumsy and suspected. 2441.54s - 2442.94s | I don't know if I can say, 2442.94s - 2444.50s | but it was a nation state threat actor 2444.50s - 2445.70s | that was suspected based on some 2445.70s - 2447.26s | of the other indicators we saw. 2448.50s - 2450.66s | And it did lead to attempted credential theft. 2450.66s - 2453.10s | So, I hope that answers your question. 2454.10s - 2455.14s | Yeah. 2460.17s - 2463.57s | If you come up, we will read it back into the mic 2463.57s - 2488.52s | and not kill you. 2488.52s - 2491.12s | So, when you're dealing with an organization 2491.12s - 2493.92s | with many, many endpoints, 2493.92s - 2496.84s | what is the low-hanging fruit when dealing with


chunk_text:
2422.58s - 2423.66s | It did require a click. 2423.66s - 2425.42s | This was not clickless as I recall. 2426.26s - 2430.86s | So, something about that image was close enough 2430.86s - 2433.02s | and familiar enough to the person sending the email 2433.02s - 2434.86s | that they didn't question it. 2434.86s - 2437.86s | It led to an attempted sign-in, 2437.86s - 2441.54s | which was rather clumsy and suspected. 2441.54s - 2442.94s | I don't know if I can say, 2442.94s - 2444.50s | but it was a nation state threat actor 2444.50s - 2445.70s | that was suspected based on some 2445.70s - 2447.26s | of the other indicators we saw. 2448.50s - 2450.66s | And it did lead to attempted credential theft. 2450.66s - 2453.10s | So, I hope that answers your question. 2454.10s - 2455.14s | Yeah. 2460.17s - 2463.57s | If you come up, we will read it back into the mic 2463.57s - 2488.52s | and not kill you. 2488.52s - 2491.12s | So, when you're dealing with an organization 2491.12s - 2493.92s | with many, many endpoints, 2493.92s - 2496.84s | what is the low-hanging fruit when dealing with tech debt, 2496.84s - 2498.20s | when you're starting to implement this? 2498.20s - 2500.12s | And I'll leave this to everybody else. 2501.56s - 2503.32s | I don't know if we have quite enough cord 2503.32s - 2505.20s | for me to answer this piece of it. 2505.20s - 2506.40s | And so, yeah. 2507.68s - 2508.52s | Just one suggestion, 2508.52s - 2509.88s | if you're talking about an organization 2509.88s - 2513.76s | that has 100,000 level systems, 2513.76s - 2515.32s | and it has a ton of tech debt, 2515.32s - 2517.24s | really hasn't done a lot yet, 2517.24s - 2518.48s | start with inventory. 2519.80s - 2522.04s | And so, it's amazing how many organizations 2522.04s - 2523.88s | don't know what computers they have, 2523.88s - 2526.24s | what systems they have hooked up to their network. 2526.24s - 2529.32s | And again, it sounds super basic, 2529.32s - 2531.76s | but it can be incredibly important 2531.76s - 2533.68s | in actually dealing with a breach, 2533.68s - 2536.44s | knowing what systems need which patches, 2536.44s - 2538.92s | where you actually need to defend yourself. 2538.92s - 2540.68s | And


chunk_text:
tech debt, 2496.84s - 2498.20s | when you're starting to implement this? 2498.20s - 2500.12s | And I'll leave this to everybody else. 2501.56s - 2503.32s | I don't know if we have quite enough cord 2503.32s - 2505.20s | for me to answer this piece of it. 2505.20s - 2506.40s | And so, yeah. 2507.68s - 2508.52s | Just one suggestion, 2508.52s - 2509.88s | if you're talking about an organization 2509.88s - 2513.76s | that has 100,000 level systems, 2513.76s - 2515.32s | and it has a ton of tech debt, 2515.32s - 2517.24s | really hasn't done a lot yet, 2517.24s - 2518.48s | start with inventory. 2519.80s - 2522.04s | And so, it's amazing how many organizations 2522.04s - 2523.88s | don't know what computers they have, 2523.88s - 2526.24s | what systems they have hooked up to their network. 2526.24s - 2529.32s | And again, it sounds super basic, 2529.32s - 2531.76s | but it can be incredibly important 2531.76s - 2533.68s | in actually dealing with a breach, 2533.68s - 2536.44s | knowing what systems need which patches, 2536.44s - 2538.92s | where you actually need to defend yourself. 2538.92s - 2540.68s | And it's also sort of impressive 2540.68s - 2543.64s | how many places don't actually have one 2543.64s - 2545.28s | that are that sort of scale. 2545.28s - 2550.83s | So, at least that's my suggested starting point. 2550.83s - 2555.24s | Start with your executives. 2555.24s - 2556.76s | Check their systems first. 2556.76s - 2559.52s | That's my personal contribution there. 2560.76s - 2566.50s | I'm gonna hit back on the human factor. 2566.50s - 2569.78s | Without some kind of a way to measure, 2569.78s - 2571.98s | track, framework, et cetera, 2571.98s - 2574.46s | of here's my standard for passwords 2574.50s - 2575.86s | that you should probably use, 2575.86s - 2578.78s | or let's not all use the same root password 2578.78s - 2580.38s | for every server out there. 2581.46s - 2582.34s | Might be a good idea, 2582.34s - 2585.02s | but how do you pass those standards down 2585.02s - 2587.46s | when the organization isn't five people, 2587.46s - 2589.14s | it's 100,000 people? 2589.14s - 2590.26s | How do you set that standard 2590.26s - 2592.78s | where the expected behavior 2592.78s - 2594.98s | is that you don't


chunk_text:
it's also sort of impressive 2540.68s - 2543.64s | how many places don't actually have one 2543.64s - 2545.28s | that are that sort of scale. 2545.28s - 2550.83s | So, at least that's my suggested starting point. 2550.83s - 2555.24s | Start with your executives. 2555.24s - 2556.76s | Check their systems first. 2556.76s - 2559.52s | That's my personal contribution there. 2560.76s - 2566.50s | I'm gonna hit back on the human factor. 2566.50s - 2569.78s | Without some kind of a way to measure, 2569.78s - 2571.98s | track, framework, et cetera, 2571.98s - 2574.46s | of here's my standard for passwords 2574.50s - 2575.86s | that you should probably use, 2575.86s - 2578.78s | or let's not all use the same root password 2578.78s - 2580.38s | for every server out there. 2581.46s - 2582.34s | Might be a good idea, 2582.34s - 2585.02s | but how do you pass those standards down 2585.02s - 2587.46s | when the organization isn't five people, 2587.46s - 2589.14s | it's 100,000 people? 2589.14s - 2590.26s | How do you set that standard 2590.26s - 2592.78s | where the expected behavior 2592.78s - 2594.98s | is that you don't likely have more than one IT team? 2594.98s - 2597.06s | So, how do you pass information along, 2597.06s - 2600.02s | and how do you also change the way people work? 2600.02s - 2601.50s | Simply put, there are some systems 2601.50s - 2604.30s | that it's just an utter pain to get to. 2605.14s - 2606.42s | So, as an IT admin, 2606.42s - 2608.74s | you're gonna come up with creative ways 2608.74s - 2611.38s | to circumvent your own security 2611.38s - 2613.74s | to be able to work on things. 2613.74s - 2615.58s | So, how do you set those standards, 2615.58s - 2617.54s | and how do you communicate them effectively 2617.54s - 2619.62s | to have an expected, 2619.62s - 2623.38s | we're all doing the same thing? 2623.38s - 2626.18s | I'll say use the free tools. 2626.18s - 2628.90s | That's how you find the low-hanging fruits. 2630.74s - 2631.78s | I keep going back there 2631.78s - 2633.02s | because that is what I experienced. 2633.02s - 2635.58s | Do not go for the new shiny tools. 2635.58s - 2639.18s | Anything that shows up as ultra-cool stuff 2639.18s -


chunk_text:
likely have more than one IT team? 2594.98s - 2597.06s | So, how do you pass information along, 2597.06s - 2600.02s | and how do you also change the way people work? 2600.02s - 2601.50s | Simply put, there are some systems 2601.50s - 2604.30s | that it's just an utter pain to get to. 2605.14s - 2606.42s | So, as an IT admin, 2606.42s - 2608.74s | you're gonna come up with creative ways 2608.74s - 2611.38s | to circumvent your own security 2611.38s - 2613.74s | to be able to work on things. 2613.74s - 2615.58s | So, how do you set those standards, 2615.58s - 2617.54s | and how do you communicate them effectively 2617.54s - 2619.62s | to have an expected, 2619.62s - 2623.38s | we're all doing the same thing? 2623.38s - 2626.18s | I'll say use the free tools. 2626.18s - 2628.90s | That's how you find the low-hanging fruits. 2630.74s - 2631.78s | I keep going back there 2631.78s - 2633.02s | because that is what I experienced. 2633.02s - 2635.58s | Do not go for the new shiny tools. 2635.58s - 2639.18s | Anything that shows up as ultra-cool stuff 2639.18s - 2641.10s | on your Twitter, on your Masternode, 2641.10s - 2642.90s | go for the basic free tools 2642.90s - 2644.78s | that have been available for eternity. 2644.78s - 2646.02s | Go for them. 2646.86s - 2648.74s | Create your own baseline. 2648.74s - 2650.82s | That would be a very good starting point. 2652.30s - 2655.26s | All of us, any one of us can be owned 2655.26s - 2657.14s | by someone sitting in their mom's basement. 2657.14s - 2659.78s | So, let's at least try to stop that. 2659.78s - 2679.66s | So, that's where you start. 2679.66s - 2681.10s | Okay. 2681.10s - 2681.94s | Yes. 2681.94s - 2682.78s | Yeah. 2682.78s - 2685.46s | So, the question is, 2685.46s - 2688.18s | who you think is a more dangerous threat, 2688.18s - 2691.62s | a kid in their mom's basement or an actual professional? 2691.62s - 2692.50s | We want to know the truth. 2692.50s - 2694.98s | In my experience, it is the kid in the basement 2694.98s - 2697.54s | because they are not limited by time. 2697.54s - 2699.02s | They can be very persistent, 2699.02s - 2700.82s | going after


chunk_text:
2641.10s | on your Twitter, on your Masternode, 2641.10s - 2642.90s | go for the basic free tools 2642.90s - 2644.78s | that have been available for eternity. 2644.78s - 2646.02s | Go for them. 2646.86s - 2648.74s | Create your own baseline. 2648.74s - 2650.82s | That would be a very good starting point. 2652.30s - 2655.26s | All of us, any one of us can be owned 2655.26s - 2657.14s | by someone sitting in their mom's basement. 2657.14s - 2659.78s | So, let's at least try to stop that. 2659.78s - 2679.66s | So, that's where you start. 2679.66s - 2681.10s | Okay. 2681.10s - 2681.94s | Yes. 2681.94s - 2682.78s | Yeah. 2682.78s - 2685.46s | So, the question is, 2685.46s - 2688.18s | who you think is a more dangerous threat, 2688.18s - 2691.62s | a kid in their mom's basement or an actual professional? 2691.62s - 2692.50s | We want to know the truth. 2692.50s - 2694.98s | In my experience, it is the kid in the basement 2694.98s - 2697.54s | because they are not limited by time. 2697.54s - 2699.02s | They can be very persistent, 2699.02s - 2700.82s | going after you for six months. 2700.82s - 2703.66s | Whereas a professional, a consultant, 2703.66s - 2706.62s | or even in your own in-house security team 2706.62s - 2708.62s | would need to get that done in 10 days, 2708.62s - 2711.94s | and you need the report on your table by 5 p.m. 2711.94s - 2714.22s | So, the kid in the basement, of course, 2714.22s - 2716.10s | persistence, consistency pays. 2717.30s - 2718.54s | Thank you. 2718.54s - 2720.94s | So, as we all respond enthusiastically, 2720.94s - 2722.70s | yes, we worry about both, 2722.70s - 2724.42s | but to your point, 2724.42s - 2725.46s | that kid in the basement, 2725.46s - 2727.82s | because that kid's pretty bored. 2727.82s - 2729.90s | That kid just wants to try things and go, 2729.90s - 2731.42s | I wonder if this works. 2731.42s - 2732.70s | If I get caught, 2732.70s - 2734.66s | do I get charged an adult with a minor? 2735.94s - 2738.06s | They have less legal liability, right? 2738.06s - 2743.40s | So, I would worry about that kid 100% of the time. 2744.16s - 2745.00s | I think this gets back


chunk_text:
you for six months. 2700.82s - 2703.66s | Whereas a professional, a consultant, 2703.66s - 2706.62s | or even in your own in-house security team 2706.62s - 2708.62s | would need to get that done in 10 days, 2708.62s - 2711.94s | and you need the report on your table by 5 p.m. 2711.94s - 2714.22s | So, the kid in the basement, of course, 2714.22s - 2716.10s | persistence, consistency pays. 2717.30s - 2718.54s | Thank you. 2718.54s - 2720.94s | So, as we all respond enthusiastically, 2720.94s - 2722.70s | yes, we worry about both, 2722.70s - 2724.42s | but to your point, 2724.42s - 2725.46s | that kid in the basement, 2725.46s - 2727.82s | because that kid's pretty bored. 2727.82s - 2729.90s | That kid just wants to try things and go, 2729.90s - 2731.42s | I wonder if this works. 2731.42s - 2732.70s | If I get caught, 2732.70s - 2734.66s | do I get charged an adult with a minor? 2735.94s - 2738.06s | They have less legal liability, right? 2738.06s - 2743.40s | So, I would worry about that kid 100% of the time. 2744.16s - 2745.00s | I think this gets back 2745.00s - 2747.28s | to the annualized lost expectancy formula. 2747.28s - 2748.60s | Honest to God, I swear, 2748.60s - 2751.04s | I'm gonna do math to my response here. 2751.04s - 2752.76s | What is the percent likelihood 2752.76s - 2755.96s | that an attack will happen in a given year 2755.96s - 2758.48s | multiplied by the dollar value 2758.48s - 2760.88s | of the impact of that incident, right? 2760.88s - 2761.72s | Okay. 2761.72s - 2764.12s | So, while the hacker kid, 2765.24s - 2767.24s | God bless us all, 2767.24s - 2771.44s | is more likely to find you personally interesting 2771.44s - 2773.56s | just to say they did it, 2773.56s - 2775.24s | to see how far they can push, 2775.24s - 2777.72s | and forget that it's a federal crime to do that. 2779.60s - 2781.12s | That's more likely. 2781.12s - 2783.24s | Let's think about what the actual dollar impact 2783.24s - 2785.60s | to the business is, frankly, right? 2785.60s - 2789.80s | Meanwhile, an APT is much less likely 2789.80s - 2792.32s | to target an organization on average, right? 2792.32s - 2794.08s | Just your average


chunk_text:
2745.00s - 2747.28s | to the annualized lost expectancy formula. 2747.28s - 2748.60s | Honest to God, I swear, 2748.60s - 2751.04s | I'm gonna do math to my response here. 2751.04s - 2752.76s | What is the percent likelihood 2752.76s - 2755.96s | that an attack will happen in a given year 2755.96s - 2758.48s | multiplied by the dollar value 2758.48s - 2760.88s | of the impact of that incident, right? 2760.88s - 2761.72s | Okay. 2761.72s - 2764.12s | So, while the hacker kid, 2765.24s - 2767.24s | God bless us all, 2767.24s - 2771.44s | is more likely to find you personally interesting 2771.44s - 2773.56s | just to say they did it, 2773.56s - 2775.24s | to see how far they can push, 2775.24s - 2777.72s | and forget that it's a federal crime to do that. 2779.60s - 2781.12s | That's more likely. 2781.12s - 2783.24s | Let's think about what the actual dollar impact 2783.24s - 2785.60s | to the business is, frankly, right? 2785.60s - 2789.80s | Meanwhile, an APT is much less likely 2789.80s - 2792.32s | to target an organization on average, right? 2792.32s - 2794.08s | Just your average organization, 2794.08s - 2796.04s | they might get caught up in a web, 2796.04s - 2797.28s | they might be a supply chain attack, 2797.28s - 2799.56s | but it's less likely that there'll be a direct target. 2799.64s - 2800.64s | On the other hand, 2800.64s - 2803.36s | the impact to the business is much greater. 2803.36s - 2807.08s | So, yes, we worry about both, 2807.08s - 2809.48s | and it's easier to get justification for the APTs 2809.48s - 2811.16s | because they're like big headlines 2811.16s - 2812.48s | and no executive wants to admit 2812.48s - 2813.72s | that they've been pwned by a teenager 2813.72s - 2815.20s | in their mom's basement, 2815.20s - 2816.20s | or their dad's actually, 2816.20s - 2819.28s | I had to share a room with my civil engineer dad. 2819.28s - 2822.12s | But you need to do that calculation 2822.12s - 2824.80s | and that risk for your own organization, 2824.80s - 2826.84s | and then move forward with the solutions 2826.84s - 2831.44s | that cost less than the actual expected incident rate. 2831.44s - 2834.28s | And that is how you will make your


chunk_text:
organization, 2794.08s - 2796.04s | they might get caught up in a web, 2796.04s - 2797.28s | they might be a supply chain attack, 2797.28s - 2799.56s | but it's less likely that there'll be a direct target. 2799.64s - 2800.64s | On the other hand, 2800.64s - 2803.36s | the impact to the business is much greater. 2803.36s - 2807.08s | So, yes, we worry about both, 2807.08s - 2809.48s | and it's easier to get justification for the APTs 2809.48s - 2811.16s | because they're like big headlines 2811.16s - 2812.48s | and no executive wants to admit 2812.48s - 2813.72s | that they've been pwned by a teenager 2813.72s - 2815.20s | in their mom's basement, 2815.20s - 2816.20s | or their dad's actually, 2816.20s - 2819.28s | I had to share a room with my civil engineer dad. 2819.28s - 2822.12s | But you need to do that calculation 2822.12s - 2824.80s | and that risk for your own organization, 2824.80s - 2826.84s | and then move forward with the solutions 2826.84s - 2831.44s | that cost less than the actual expected incident rate. 2831.44s - 2834.28s | And that is how you will make your finance people love you. 2834.28s - 2835.68s | And that requires learning about 2835.68s - 2836.88s | who you think is attacking you 2836.88s - 2840.86s | and knowing what you have to protect. 2840.86s - 2842.58s | I think the question is a trap. 2845.54s - 2849.42s | So, I think the only right answer to that is it depends. 2850.42s - 2854.34s | But, and so, whichever is successful 2854.34s - 2856.30s | and causes damage to you in a way 2856.30s - 2858.26s | that actually harms your organization 2858.86s - 2859.70s | is the one that matters. 2859.70s - 2861.06s | And that can be anyone. 2861.06s - 2864.46s | That can be a script that got loose, went wrong. 2864.46s - 2868.18s | That can be just a DDoS that accidentally got released, 2868.18s - 2869.42s | but took out your network 2869.42s - 2871.58s | and caused you to lose that big sale. 2871.58s - 2875.22s | So, it can be anyone. 2875.22s - 2878.30s | We do have a big focus on talking about state actors 2878.30s - 2881.26s | because they're a unit that we can really consider, 2881.26s - 2883.74s |


chunk_text:
finance people love you. 2834.28s - 2835.68s | And that requires learning about 2835.68s - 2836.88s | who you think is attacking you 2836.88s - 2840.86s | and knowing what you have to protect. 2840.86s - 2842.58s | I think the question is a trap. 2845.54s - 2849.42s | So, I think the only right answer to that is it depends. 2850.42s - 2854.34s | But, and so, whichever is successful 2854.34s - 2856.30s | and causes damage to you in a way 2856.30s - 2858.26s | that actually harms your organization 2858.86s - 2859.70s | is the one that matters. 2859.70s - 2861.06s | And that can be anyone. 2861.06s - 2864.46s | That can be a script that got loose, went wrong. 2864.46s - 2868.18s | That can be just a DDoS that accidentally got released, 2868.18s - 2869.42s | but took out your network 2869.42s - 2871.58s | and caused you to lose that big sale. 2871.58s - 2875.22s | So, it can be anyone. 2875.22s - 2878.30s | We do have a big focus on talking about state actors 2878.30s - 2881.26s | because they're a unit that we can really consider, 2881.26s - 2883.74s | that we've got cool names for them. 2883.74s - 2887.14s | We might have giant statues of them at Black Hat. 2887.18s - 2890.46s | But, you know, it can be anyone 2890.46s - 2893.94s | that can cause sort of any impact to the organization. 2897.99s - 2900.79s | I think that's our last question. 2900.79s - 2902.67s | The goons are about to kick us out. 2902.67s - 2905.27s | So, before that, I will just add one more point. 2905.27s - 2906.91s | So, this is the power of community, 2906.91s - 2909.31s | like the hacker community, 2909.31s - 2912.95s | because we create new tools. 2912.95s - 2915.27s | We talk, I mean, we teach each other. 2915.27s - 2917.47s | We kind of, you know, use that in use, 2917.47s - 2918.95s | you know, increase our defenses. 2919.71s - 2923.11s | So, again, it is always good to be in the hacker community. 2924.23s - 2928.51s | I mean, because from my personal experience, 2929.19s - 2931.31s | if I'm sitting here along with these folks, 2931.31s - 2933.59s | that is a part of community, right? 2933.59s - 2936.99s | And I


chunk_text:
that we've got cool names for them. 2883.74s - 2887.14s | We might have giant statues of them at Black Hat. 2887.18s - 2890.46s | But, you know, it can be anyone 2890.46s - 2893.94s | that can cause sort of any impact to the organization. 2897.99s - 2900.79s | I think that's our last question. 2900.79s - 2902.67s | The goons are about to kick us out. 2902.67s - 2905.27s | So, before that, I will just add one more point. 2905.27s - 2906.91s | So, this is the power of community, 2906.91s - 2909.31s | like the hacker community, 2909.31s - 2912.95s | because we create new tools. 2912.95s - 2915.27s | We talk, I mean, we teach each other. 2915.27s - 2917.47s | We kind of, you know, use that in use, 2917.47s - 2918.95s | you know, increase our defenses. 2919.71s - 2923.11s | So, again, it is always good to be in the hacker community. 2924.23s - 2928.51s | I mean, because from my personal experience, 2929.19s - 2931.31s | if I'm sitting here along with these folks, 2931.31s - 2933.59s | that is a part of community, right? 2933.59s - 2936.99s | And I would like to thank the panel, the entire panel, 2936.99s - 2939.51s | DEF CON, all the amazing goons out here, 2939.51s - 2941.59s | all the, you know, participants. 2942.15s - 2943.55s | Thank you. Thanks a lot. 2943.55s - 2947.03s | And shameless plug, do visit Advasive Village. 2947.03s - 2949.11s | Yeah. Thank you.


chunk_text:
would like to thank the panel, the entire panel, 2936.99s - 2939.51s | DEF CON, all the amazing goons out here, 2939.51s - 2941.59s | all the, you know, participants. 2942.15s - 2943.55s | Thank you. Thanks a lot. 2943.55s - 2947.03s | And shameless plug, do visit Advasive Village. 2947.03s - 2949.11s | Yeah. Thank you.


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=VTkAx3Ub6-I", "title": "DEF CON 32 - DIY Pharmaceuticals - Michael Laufer", "description": "A quarter million people die from Hepatitis C yearly, and it's getting worse. But for the first time in history there is a cure (not just a treatment) for a virus, and it is for Hepatitis C. Take one 400mg pill of Sofosbuvir every day for twelve weeks, and you will be free of the virus. The catch? Those pills are $1,000 USD apiece because the molecule is the so-called \"Intellectual Property\" of Gilead Pharmaceuticals, and they refuse to share. If you have $84,000 USD, Hep C is not your problem. We have developed a way to make the entire course of treatment for $300 USD. This methodology also applies to other diseases. Like any science, the method of manufacture of drugs can be replicated, and we are going to give you all the necessary tools and show you the process top-to-bottom. Watch it happen live, participate, and learn to do it yourself: Use our digital research assistant to help you navigate the scientific literature, get a chemical synthesis pathway, generate code for the the MicroLab to run, and watch the medicine form in the reaction chamber. Finally, press some tablets. The feds say saving a life this way is BioTerrorism. We say: So Be It.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2868, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.12s | This text was transcribed using whisper model: large-v2 how many people came yesterday to thank you so much i had a great time wasn't that fun i had a 7.12s - 15.36s | really i had a really good time so um predictably we are having uh some more av issues uh this is 15.36s - 22.08s | restarting and we've got people who are setting up like actual sciency chemistry stuff and doing 22.08s - 31.12s | shots over here um so yesterday we did a lot of the why uh we talked a great deal about sort of 31.84s - 40.96s | what motivates the work and uh what we're hoping to accomplish with it today is more of the 41.84s - 49.44s | the what and the how so uh hopefully this will pop up in a second um and when it does 50.40s - 61.36s | um if we're lucky and a bunch of other stuff don't get in the way


chunk_text:
chamber. Finally, press some tablets. The feds say saving a life this way is BioTerrorism. We say: So Be It.", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2868, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 7.12s | This text was transcribed using whisper model: large-v2 how many people came yesterday to thank you so much i had a great time wasn't that fun i had a 7.12s - 15.36s | really i had a really good time so um predictably we are having uh some more av issues uh this is 15.36s - 22.08s | restarting and we've got people who are setting up like actual sciency chemistry stuff and doing 22.08s - 31.12s | shots over here um so yesterday we did a lot of the why uh we talked a great deal about sort of 31.84s - 40.96s | what motivates the work and uh what we're hoping to accomplish with it today is more of the 41.84s - 49.44s | the what and the how so uh hopefully this will pop up in a second um and when it does 50.40s - 61.36s | um if we're lucky and a bunch of other stuff don't get in the way um we can get started um 62.16s - 65.84s | we're going to show you the micro lab we're going to show you the online services 66.64s - 74.80s | and we're going to show you oh and vinny's light works so so you're going to see the um 75.76s - 80.64s | the micro lab in progress um we're going to talk about how it's put together a hardware 80.64s - 86.64s | and software stack and additionally you're going to be able to see the online services which will 86.64s - 93.44s | be running uh live that's sort of the problem that we're having um we will swap over to a 93.44s - 102.24s | different machine when that happens and um i think we should be good to go here so i gotta stay close 102.24s - 114.30s | to the mic i gotta remember that um okay dope so if you're trying to do pharmaceuticals diy 114.94s - 118.94s | there are a number of pieces that have to happen the first thing is you have to actually do the 118.94s - 124.86s | chemistry and the micro lab which you see being built next


chunk_text:
um we can get started um 62.16s - 65.84s | we're going to show you the micro lab we're going to show you the online services 66.64s - 74.80s | and we're going to show you oh and vinny's light works so so you're going to see the um 75.76s - 80.64s | the micro lab in progress um we're going to talk about how it's put together a hardware 80.64s - 86.64s | and software stack and additionally you're going to be able to see the online services which will 86.64s - 93.44s | be running uh live that's sort of the problem that we're having um we will swap over to a 93.44s - 102.24s | different machine when that happens and um i think we should be good to go here so i gotta stay close 102.24s - 114.30s | to the mic i gotta remember that um okay dope so if you're trying to do pharmaceuticals diy 114.94s - 118.94s | there are a number of pieces that have to happen the first thing is you have to actually do the 118.94s - 124.86s | chemistry and the micro lab which you see being built next to me here is the system that we've 124.86s - 132.62s | developed for helping that process and making it more automated what that allows for is that 132.62s - 137.82s | somebody who is not super comfortable with chemistry can still participate a lot of people 137.82s - 144.54s | look at that sort of thing and get really nervous really fast yesterday i think i likened it to the 144.54s - 149.18s | difference between building a computer versus using a computer if you're not looking to become 149.18s - 154.14s | a chemist but you're you you're looking to utilize chemistry somehow to do something 155.50s - 160.62s | the skill set that you have to acquire is much less and if you have an automated system that 160.62s - 165.34s | can help you through the hard parts and talk you through the easy parts then you can do that 166.70s - 171.66s | antecedent to that you need to be able to write the programs that the hardware will actually run 172.54s - 177.82s | this is the recipe press which you'll also see and this allows you to stack a procedure together 178.62s -


chunk_text:
to me here is the system that we've 124.86s - 132.62s | developed for helping that process and making it more automated what that allows for is that 132.62s - 137.82s | somebody who is not super comfortable with chemistry can still participate a lot of people 137.82s - 144.54s | look at that sort of thing and get really nervous really fast yesterday i think i likened it to the 144.54s - 149.18s | difference between building a computer versus using a computer if you're not looking to become 149.18s - 154.14s | a chemist but you're you you're looking to utilize chemistry somehow to do something 155.50s - 160.62s | the skill set that you have to acquire is much less and if you have an automated system that 160.62s - 165.34s | can help you through the hard parts and talk you through the easy parts then you can do that 166.70s - 171.66s | antecedent to that you need to be able to write the programs that the hardware will actually run 172.54s - 177.82s | this is the recipe press which you'll also see and this allows you to stack a procedure together 178.62s - 184.86s | and get code into the machine so that it can execute the procedures that you want to do 185.50s - 190.38s | antecedent to that you need to figure out what sort of chemistry you're doing you need to do 190.38s - 195.82s | what's called retrosynthesis how do you start with a starting material and then work your way 195.82s - 200.78s | from point a to point b and of course before that somewhere you have to actually figure out how 200.78s - 206.86s | you're addressing your health and what you want as a drug that you want to take so let's take a 206.86s - 212.70s | quick look at each of these here's how it kind of stacks together this is a flow chart that was sort 212.70s - 218.46s | of put together you want to again figure out what is wrong in a medical sense that's your first bar 218.46s - 223.98s | there then you need to figure out what the active pharmaceutical ingredient i know all of you 223.98s - 228.86s | hackers think of something very different when we say api but api also stands for active 228.86s


chunk_text:
184.86s | and get code into the machine so that it can execute the procedures that you want to do 185.50s - 190.38s | antecedent to that you need to figure out what sort of chemistry you're doing you need to do 190.38s - 195.82s | what's called retrosynthesis how do you start with a starting material and then work your way 195.82s - 200.78s | from point a to point b and of course before that somewhere you have to actually figure out how 200.78s - 206.86s | you're addressing your health and what you want as a drug that you want to take so let's take a 206.86s - 212.70s | quick look at each of these here's how it kind of stacks together this is a flow chart that was sort 212.70s - 218.46s | of put together you want to again figure out what is wrong in a medical sense that's your first bar 218.46s - 223.98s | there then you need to figure out what the active pharmaceutical ingredient i know all of you 223.98s - 228.86s | hackers think of something very different when we say api but api also stands for active 228.86s - 235.02s | pharmaceutical ingredient then you develop the synthesis pathway you get a procedure for it and 235.02s - 241.18s | then you develop a file that the machine will run you run the machine and then again at the end you 241.18s - 244.78s | have to actually turn your active pharmaceutical ingredient into something that you can take 245.58s - 251.74s | if it's just a white powder i mean some people might want to just snort it but like better if 251.74s - 257.42s | you put it in a pill or maybe you put it into some sort of solution that becomes an iv drip 257.42s - 263.66s | eventually you have to compound it some way so let's look at the automated chemistry again 264.54s - 272.26s | chemical automation is not a new idea these are available commercially but it's closed source all 272.66s - 277.54s | the problems that come with that of course on top of that they're ridiculously expensive 279.30s - 283.06s | five five thousand dollars i think for like the cheapest jankiest model which is the one you're 283.06s - 289.42s | looking at you can't even buy


chunk_text:
- 235.02s | pharmaceutical ingredient then you develop the synthesis pathway you get a procedure for it and 235.02s - 241.18s | then you develop a file that the machine will run you run the machine and then again at the end you 241.18s - 244.78s | have to actually turn your active pharmaceutical ingredient into something that you can take 245.58s - 251.74s | if it's just a white powder i mean some people might want to just snort it but like better if 251.74s - 257.42s | you put it in a pill or maybe you put it into some sort of solution that becomes an iv drip 257.42s - 263.66s | eventually you have to compound it some way so let's look at the automated chemistry again 264.54s - 272.26s | chemical automation is not a new idea these are available commercially but it's closed source all 272.66s - 277.54s | the problems that come with that of course on top of that they're ridiculously expensive 279.30s - 283.06s | five five thousand dollars i think for like the cheapest jankiest model which is the one you're 283.06s - 289.42s | looking at you can't even buy them if you want to pay five thousand dollars because 290.54s - 297.42s | they're only sold to labs and you know on top of that they aren't modular they don't expand 298.14s - 303.10s | so if you want something that does something else you need to buy the next model up you can't just 303.10s - 308.14s | put a new module in and at the end of the day they don't work very well but you can see they're 308.14s - 314.06s | not terribly complicated there's an inner chamber you can see this blue fluid there there's a little 314.62s - 322.06s | teflon paddle that stirs outside there's a jacket and that is circulating a fluid that maintains 322.06s - 329.42s | the temperature of the reaction and on top there is something injecting reagents so we don't like 329.42s - 335.82s | all these poor features of the commercial version so here's our version again you can see it right 335.82s - 342.14s | over here and if you'll note they're not that much different because functionally they're doing the 342.14s - 349.18s | same thing you got something that stirs that's that inner


chunk_text:
them if you want to pay five thousand dollars because 290.54s - 297.42s | they're only sold to labs and you know on top of that they aren't modular they don't expand 298.14s - 303.10s | so if you want something that does something else you need to buy the next model up you can't just 303.10s - 308.14s | put a new module in and at the end of the day they don't work very well but you can see they're 308.14s - 314.06s | not terribly complicated there's an inner chamber you can see this blue fluid there there's a little 314.62s - 322.06s | teflon paddle that stirs outside there's a jacket and that is circulating a fluid that maintains 322.06s - 329.42s | the temperature of the reaction and on top there is something injecting reagents so we don't like 329.42s - 335.82s | all these poor features of the commercial version so here's our version again you can see it right 335.82s - 342.14s | over here and if you'll note they're not that much different because functionally they're doing the 342.14s - 349.18s | same thing you got something that stirs that's that inner chamber also with a blue fluid there's 349.18s - 355.18s | a teflon little paddle that spins you've got an outer jar both of these are just mason jars 355.18s - 360.94s | the outer jar has a circulating fluid and that circulating fluid maintains the temperature 361.82s - 368.62s | and on the top you have peristaltic pumps which pull from those syringes to inject reagents 368.62s - 374.22s | and then there's a little box next to it and that is the brain that executes all these commands so 374.22s - 379.82s | let's see if we can take a look at all the bits and pieces of this uh this of course is entirely 379.82s - 386.54s | open source you can build it yourself in fact that's the only way you can get it the documentation 386.54s - 390.62s | team did a phenomenal job and you will get a wonderful walk through if you decide to visit 390.62s - 397.84s | our github remember documentation or it's not a project you can make this whole thing for 300 bucks 398.40s - 401.60s | probably less for most of you because you'll have a lot of


chunk_text:
chamber also with a blue fluid there's 349.18s - 355.18s | a teflon little paddle that spins you've got an outer jar both of these are just mason jars 355.18s - 360.94s | the outer jar has a circulating fluid and that circulating fluid maintains the temperature 361.82s - 368.62s | and on the top you have peristaltic pumps which pull from those syringes to inject reagents 368.62s - 374.22s | and then there's a little box next to it and that is the brain that executes all these commands so 374.22s - 379.82s | let's see if we can take a look at all the bits and pieces of this uh this of course is entirely 379.82s - 386.54s | open source you can build it yourself in fact that's the only way you can get it the documentation 386.54s - 390.62s | team did a phenomenal job and you will get a wonderful walk through if you decide to visit 390.62s - 397.84s | our github remember documentation or it's not a project you can make this whole thing for 300 bucks 398.40s - 401.60s | probably less for most of you because you'll have a lot of this stuff lying around 403.52s - 408.24s | and if you're not the sort of person who feels terribly handy you don't have to worry about it 408.24s - 414.16s | everything either snaps together or is screw connectors this is not like a fancy difficult 414.16s - 420.40s | project where you're gonna have to do surface mount rework or anything also there are open ports 421.12s - 426.24s | you can reconfigure this if you want other things to happen you want to control atmosphere or you 426.24s - 432.32s | want pressure or you want feedback from a ph meter all these things can be done because it's hackable 432.32s - 437.92s | because if you can't rebuild it you don't own it so let's look at all the bits and pieces here 437.92s - 444.24s | oh right and actually it works for those of you who saw what i took yesterday you know 445.20s - 453.04s | and boy did i have the best glitter poop this morning all right let's take a look so this is 453.04s - 459.12s | the wonderful logo and tagline for the micro lab this was an off-the-cuff statement


chunk_text:
this stuff lying around 403.52s - 408.24s | and if you're not the sort of person who feels terribly handy you don't have to worry about it 408.24s - 414.16s | everything either snaps together or is screw connectors this is not like a fancy difficult 414.16s - 420.40s | project where you're gonna have to do surface mount rework or anything also there are open ports 421.12s - 426.24s | you can reconfigure this if you want other things to happen you want to control atmosphere or you 426.24s - 432.32s | want pressure or you want feedback from a ph meter all these things can be done because it's hackable 432.32s - 437.92s | because if you can't rebuild it you don't own it so let's look at all the bits and pieces here 437.92s - 444.24s | oh right and actually it works for those of you who saw what i took yesterday you know 445.20s - 453.04s | and boy did i have the best glitter poop this morning all right let's take a look so this is 453.04s - 459.12s | the wonderful logo and tagline for the micro lab this was an off-the-cuff statement but i thought 459.12s - 470.45s | we should stick with it now the micro lab itself is broken down into an architecture 471.41s - 476.61s | all of you who are the more technical will recognize these bits and pieces these i will 476.61s - 481.33s | be able to speak to a little bit but they were all built by people who are more skilled at these 481.33s - 487.89s | things than i am but if you can look it's not terribly sclerotic but there are a lot of different 487.89s - 495.12s | things that are happening here's the machine itself and again you're looking at one of them 495.12s - 500.40s | and again you're looking at one of them to the left and let's look at the pieces so 502.16s - 510.32s | you have the reaction chamber itself this is two mason jars one which sits within the other 510.32s - 516.88s | and there's a 3d printed armature it's called the we call it the reactor core which allows these to 516.88s - 521.36s | screw together so that the inner jar floats while the outer jar can have the circulating fluid


chunk_text:
but i thought 459.12s - 470.45s | we should stick with it now the micro lab itself is broken down into an architecture 471.41s - 476.61s | all of you who are the more technical will recognize these bits and pieces these i will 476.61s - 481.33s | be able to speak to a little bit but they were all built by people who are more skilled at these 481.33s - 487.89s | things than i am but if you can look it's not terribly sclerotic but there are a lot of different 487.89s - 495.12s | things that are happening here's the machine itself and again you're looking at one of them 495.12s - 500.40s | and again you're looking at one of them to the left and let's look at the pieces so 502.16s - 510.32s | you have the reaction chamber itself this is two mason jars one which sits within the other 510.32s - 516.88s | and there's a 3d printed armature it's called the we call it the reactor core which allows these to 516.88s - 521.36s | screw together so that the inner jar floats while the outer jar can have the circulating fluid 522.08s - 525.12s | this is what it looks like if you can't see super well 526.72s - 532.00s | that piece that you see in the top that is the motor that runs the stirring paddle in the bottom 533.44s - 540.56s | here's the actual core and it comes in three pieces and breaks apart like this snaps together 540.56s - 548.08s | very nicely easy to construct now if you look at the rest of the armature here that purple box 548.08s - 555.20s | houses both the circulation pumps for hot and cold fluid it also holds the peristaltic pumps 555.20s - 561.76s | which pull from the syringes and then there's this armature that holds it all together again 561.76s - 567.92s | this is what it looks like if you can't see super close let's take a look at the armature real quick 567.92s - 574.56s | now for those of you who are mechanical engineering inclined you'll notice that it's asymmetric and 574.56s - 578.48s | you might ask the question well why would that be that doesn't make a whole lot of sense was that 578.48s - 592.13s | unintentional and yes


chunk_text:
522.08s - 525.12s | this is what it looks like if you can't see super well 526.72s - 532.00s | that piece that you see in the top that is the motor that runs the stirring paddle in the bottom 533.44s - 540.56s | here's the actual core and it comes in three pieces and breaks apart like this snaps together 540.56s - 548.08s | very nicely easy to construct now if you look at the rest of the armature here that purple box 548.08s - 555.20s | houses both the circulation pumps for hot and cold fluid it also holds the peristaltic pumps 555.20s - 561.76s | which pull from the syringes and then there's this armature that holds it all together again 561.76s - 567.92s | this is what it looks like if you can't see super close let's take a look at the armature real quick 567.92s - 574.56s | now for those of you who are mechanical engineering inclined you'll notice that it's asymmetric and 574.56s - 578.48s | you might ask the question well why would that be that doesn't make a whole lot of sense was that 578.48s - 592.13s | unintentional and yes it was intentional because our designers are awesome so now that we remember 592.13s - 600.16s | why we're here let's put it back together and let's take a quick look at the brain now the brain 600.16s - 608.64s | here is uh again 3d printed outside um top pops off and you can see the bits and pieces under the 608.64s - 615.68s | hood here uh this is a version with an acrylic top again if you're close up or you come up later 615.68s - 620.72s | you'll be able to actually see it it's sitting right here and you can see that you know there's 620.72s - 626.32s | a bunch of wires but it's not too much to deal with and we can take a look at each of these 626.32s - 632.48s | individual pieces so here again you can see how it's wired it's not too terribly much and a lot 632.48s - 637.92s | of these are already ported the connectors at the top you'll see your screw terminals and these allow 638.64s - 647.60s | us to connect the brain unit to the armature itself you have a relay board


chunk_text:
it was intentional because our designers are awesome so now that we remember 592.13s - 600.16s | why we're here let's put it back together and let's take a quick look at the brain now the brain 600.16s - 608.64s | here is uh again 3d printed outside um top pops off and you can see the bits and pieces under the 608.64s - 615.68s | hood here uh this is a version with an acrylic top again if you're close up or you come up later 615.68s - 620.72s | you'll be able to actually see it it's sitting right here and you can see that you know there's 620.72s - 626.32s | a bunch of wires but it's not too much to deal with and we can take a look at each of these 626.32s - 632.48s | individual pieces so here again you can see how it's wired it's not too terribly much and a lot 632.48s - 637.92s | of these are already ported the connectors at the top you'll see your screw terminals and these allow 638.64s - 647.60s | us to connect the brain unit to the armature itself you have a relay board there's an arduino 648.48s - 656.32s | that controls the pumps the main brain is a raspberry pi and then there's an interface that 656.32s - 661.68s | is this touch screen these are really slick connectors and it makes it so that you can take 661.68s - 666.88s | it apart and maybe you notice vinny over here who managed to put this together in 10 minutes just 666.88s - 671.92s | from bringing it in cases this is a really easy system to use and thank you vinny wherever you are 678.99s - 686.53s | so here you can see kind of how it's broken out you've got these nice little snap togethers the 686.53s - 694.29s | relay board again controls a number of things there is a pid module that regulates temperature 694.29s - 699.25s | and so you've got a heating element that's going to kick on or off as it predicts the curve of 699.25s - 704.29s | temperature as it moves try and smooth out transitions additionally you've got something 704.29s - 710.29s | that turns the stir motor on and off and also it's expandable there are a few other things that


chunk_text:
there's an arduino 648.48s - 656.32s | that controls the pumps the main brain is a raspberry pi and then there's an interface that 656.32s - 661.68s | is this touch screen these are really slick connectors and it makes it so that you can take 661.68s - 666.88s | it apart and maybe you notice vinny over here who managed to put this together in 10 minutes just 666.88s - 671.92s | from bringing it in cases this is a really easy system to use and thank you vinny wherever you are 678.99s - 686.53s | so here you can see kind of how it's broken out you've got these nice little snap togethers the 686.53s - 694.29s | relay board again controls a number of things there is a pid module that regulates temperature 694.29s - 699.25s | and so you've got a heating element that's going to kick on or off as it predicts the curve of 699.25s - 704.29s | temperature as it moves try and smooth out transitions additionally you've got something 704.29s - 710.29s | that turns the stir motor on and off and also it's expandable there are a few other things that 710.29s - 715.57s | you can do um i think we had a light on one of the earlier ones would have been nice in this 716.45s - 722.93s | room with the mood lighting but um and then again uh the systems run on either 5 or 12 volts and 722.93s - 730.29s | there's a little controller in there uh you can see also here uh this is an arduino uno and the cnc 730.29s - 736.29s | shield that believe i said this already but that controls the pumps so those are essentially just 736.29s - 744.45s | stepper motors and so it's pretty simple to have a g-code interpreter just send commands to say 744.45s - 748.61s | turn it this much and one of the things that's important about this is that when you're doing 748.61s - 759.49s | chemistry most steps in most procedures for doing synthesis say add this amount of this thing 760.69s - 766.93s | this quickly or slowly then bring it to this temperature and stir it for this long and so 766.93s - 771.97s | one of the things that it allows us to do is a recent update


chunk_text:
710.29s - 715.57s | you can do um i think we had a light on one of the earlier ones would have been nice in this 716.45s - 722.93s | room with the mood lighting but um and then again uh the systems run on either 5 or 12 volts and 722.93s - 730.29s | there's a little controller in there uh you can see also here uh this is an arduino uno and the cnc 730.29s - 736.29s | shield that believe i said this already but that controls the pumps so those are essentially just 736.29s - 744.45s | stepper motors and so it's pretty simple to have a g-code interpreter just send commands to say 744.45s - 748.61s | turn it this much and one of the things that's important about this is that when you're doing 748.61s - 759.49s | chemistry most steps in most procedures for doing synthesis say add this amount of this thing 760.69s - 766.93s | this quickly or slowly then bring it to this temperature and stir it for this long and so 766.93s - 771.97s | one of the things that it allows us to do is a recent update that's really great you can say 772.53s - 776.37s | add this over this amount of time and this allows for a lot more things to be done 777.57s - 782.13s | so looking at the bits and pieces here's how they float you can see again the touch screen 782.13s - 788.53s | snaps into the raspberry pi on the other side you can see the arduino that has the 788.53s - 795.01s | cnc hat on it the bottom piece is the voltage regulator and the top is the 797.33s - 803.89s | relay control and again you don't have to build it like this one of the things that's wonderful 803.89s - 807.49s | is that this is reconfigurable if you don't like it flat and you want a tower instead you can 807.49s - 814.37s | totally do it the relay board you can actually even snap in between the raspberry pi and the 814.37s - 818.77s | screen if you want but you have to have a taller box so aesthetic principles apply 819.33s - 825.65s | remix and revisit as you see fit here you can see how the screen actually snaps in 827.01s


chunk_text:
that's really great you can say 772.53s - 776.37s | add this over this amount of time and this allows for a lot more things to be done 777.57s - 782.13s | so looking at the bits and pieces here's how they float you can see again the touch screen 782.13s - 788.53s | snaps into the raspberry pi on the other side you can see the arduino that has the 788.53s - 795.01s | cnc hat on it the bottom piece is the voltage regulator and the top is the 797.33s - 803.89s | relay control and again you don't have to build it like this one of the things that's wonderful 803.89s - 807.49s | is that this is reconfigurable if you don't like it flat and you want a tower instead you can 807.49s - 814.37s | totally do it the relay board you can actually even snap in between the raspberry pi and the 814.37s - 818.77s | screen if you want but you have to have a taller box so aesthetic principles apply 819.33s - 825.65s | remix and revisit as you see fit here you can see how the screen actually snaps in 827.01s - 833.81s | and here's the cnc board again it's a it's a real simple little unit uh comes in a little kit and 833.81s - 839.17s | you just snap everything together here again you can see these wonderful connectors they're really 839.17s - 844.53s | really robust and there are a lot of wires there but you just have to count them in and screw them 844.53s - 850.29s | down it's not um what is the term rocket surgery uh here's the voltage controller that will give 850.29s - 859.25s | you out both uh five volts and 12 and again screw terminals for all of these things a really nice 859.25s - 867.89s | system to work with uh i've enjoyed it so um moving forward i'll see uh this is again that 867.89s - 873.65s | same connector and are we back all right now here you see it working now you might be able to see it 873.65s - 884.69s | working here it is currently stirring look at that thing and just so you know this isn't just stirring 884.69s - 891.09s | nothing both in this video and what you see here


chunk_text:
- 833.81s | and here's the cnc board again it's a it's a real simple little unit uh comes in a little kit and 833.81s - 839.17s | you just snap everything together here again you can see these wonderful connectors they're really 839.17s - 844.53s | really robust and there are a lot of wires there but you just have to count them in and screw them 844.53s - 850.29s | down it's not um what is the term rocket surgery uh here's the voltage controller that will give 850.29s - 859.25s | you out both uh five volts and 12 and again screw terminals for all of these things a really nice 859.25s - 867.89s | system to work with uh i've enjoyed it so um moving forward i'll see uh this is again that 867.89s - 873.65s | same connector and are we back all right now here you see it working now you might be able to see it 873.65s - 884.69s | working here it is currently stirring look at that thing and just so you know this isn't just stirring 884.69s - 891.09s | nothing both in this video and what you see here is actually manufacturing medicine and you will 891.09s - 898.21s | watch me extract it at the end here so it's not just a demo proof of concept we've used this for 898.21s - 910.35s | many things and it works great so i'm excited at the end and what you'll see me do soon is you'll 910.35s - 918.43s | end up with the inner jar filled with active pharmaceutical ingredient in a solvent of some 918.43s - 925.95s | sort and then you pour it through a coffee filter and then you let it dry and it basically looks 925.95s - 931.87s | like this it's a fairly simple thing you dump it out you let it drip for a while now we're not 931.87s - 937.39s | going to have time to let it dry and watch but once it does you can see there's this little powder 937.39s - 945.07s | that's left on the bottom and then you peel it open and there's your stuff so anybody who says 945.07s - 950.43s | you know chemistry is scary or if this sort of makes you nervous you maybe remember some weird 950.43s - 956.59s |


chunk_text:
is actually manufacturing medicine and you will 891.09s - 898.21s | watch me extract it at the end here so it's not just a demo proof of concept we've used this for 898.21s - 910.35s | many things and it works great so i'm excited at the end and what you'll see me do soon is you'll 910.35s - 918.43s | end up with the inner jar filled with active pharmaceutical ingredient in a solvent of some 918.43s - 925.95s | sort and then you pour it through a coffee filter and then you let it dry and it basically looks 925.95s - 931.87s | like this it's a fairly simple thing you dump it out you let it drip for a while now we're not 931.87s - 937.39s | going to have time to let it dry and watch but once it does you can see there's this little powder 937.39s - 945.07s | that's left on the bottom and then you peel it open and there's your stuff so anybody who says 945.07s - 950.43s | you know chemistry is scary or if this sort of makes you nervous you maybe remember some weird 950.43s - 956.59s | person in high school who abused you with like orbital theory and you know stoichiometric balancing 956.59s - 961.87s | like yeah if you wanted to pursue a career in chemistry you might have to follow that but if 961.87s - 970.75s | you just want to use chemistry it's not so bad so um i'm going to have to sort of walk through uh 971.71s - 975.95s | this system uh these next two systems and then we'll swap computers and then hopefully i'll be 975.95s - 984.67s | able to show this to you live um one of our guys has a stack of note cards and pens i will take 984.67s - 988.83s | questions at the end but you got to write them down and then i'll collect them now this is if 988.83s - 994.67s | you have general questions about anything we're doing and or if when i do the live thing you want 994.67s - 998.99s | to see if we can figure out a way to synthesize your molecule choice i probably won't be able to 998.99s - 1003.55s | do a lot of them but if somebody has a good interesting


chunk_text:
person in high school who abused you with like orbital theory and you know stoichiometric balancing 956.59s - 961.87s | like yeah if you wanted to pursue a career in chemistry you might have to follow that but if 961.87s - 970.75s | you just want to use chemistry it's not so bad so um i'm going to have to sort of walk through uh 971.71s - 975.95s | this system uh these next two systems and then we'll swap computers and then hopefully i'll be 975.95s - 984.67s | able to show this to you live um one of our guys has a stack of note cards and pens i will take 984.67s - 988.83s | questions at the end but you got to write them down and then i'll collect them now this is if 988.83s - 994.67s | you have general questions about anything we're doing and or if when i do the live thing you want 994.67s - 998.99s | to see if we can figure out a way to synthesize your molecule choice i probably won't be able to 998.99s - 1003.55s | do a lot of them but if somebody has a good interesting one we'll pull it down and take a 1003.55s - 1010.19s | look okay so uh who's got the cards so look at this gentleman in the nice shirt here he'll be 1010.19s - 1015.31s | walking around raise your hand if you want a card and write down your question so if you're trying 1015.31s - 1021.63s | to figure out a reaction procedure and you go into the chemical literature it's difficult because 1021.63s - 1027.95s | it's not really a procedure it's just here's how i did it so there's a lot of decoding again it's 1027.95s - 1034.83s | not necessarily the only way to do it it might be the easy way that somebody found so it's highly 1034.83s - 1040.67s | subjective of course it also has a bunch of jargon that if you don't have a degree in chemistry 1040.67s - 1045.71s | might be pretty hard to deal with and on top of that you have to dig through the literature to 1045.71s - 1053.55s | find it and one of the things that i'm super excited about is once more people start using 1053.55s - 1059.07s | this if you say


chunk_text:
one we'll pull it down and take a 1003.55s - 1010.19s | look okay so uh who's got the cards so look at this gentleman in the nice shirt here he'll be 1010.19s - 1015.31s | walking around raise your hand if you want a card and write down your question so if you're trying 1015.31s - 1021.63s | to figure out a reaction procedure and you go into the chemical literature it's difficult because 1021.63s - 1027.95s | it's not really a procedure it's just here's how i did it so there's a lot of decoding again it's 1027.95s - 1034.83s | not necessarily the only way to do it it might be the easy way that somebody found so it's highly 1034.83s - 1040.67s | subjective of course it also has a bunch of jargon that if you don't have a degree in chemistry 1040.67s - 1045.71s | might be pretty hard to deal with and on top of that you have to dig through the literature to 1045.71s - 1053.55s | find it and one of the things that i'm super excited about is once more people start using 1053.55s - 1059.07s | this if you say hey i figured out how to make xyz on the micro lab and you build a file for it 1059.07s - 1065.23s | you can just trade it you can just torrent your drug of choice i mean 1067.23s - 1078.19s | shouldn't you be able to download everything why not medicine so let's look at this wonderful 1078.19s - 1084.75s | system that's been built this is hard let's look at the easy version this is this wonderful gooey 1084.75s - 1092.51s | and you'll oh you may have seen this this is our uh little uh little captcha here so uh select 1092.51s - 1097.47s | our pharmaceutical companies which have not settled for over 500 million us dollars for 1097.47s - 1103.95s | off-label promotion and kickbacks if there are none clicks yeah yeah okay all right moving on 1105.15s - 1110.51s | you can see there are two different types of steps here one is the dark blue that's something 1110.51s - 1115.07s | that's actually automated that's something that the computer is doing then the turquoise 1116.19s - 1120.43s | that is a human step so of course the machine can't load itself full of


chunk_text:
hey i figured out how to make xyz on the micro lab and you build a file for it 1059.07s - 1065.23s | you can just trade it you can just torrent your drug of choice i mean 1067.23s - 1078.19s | shouldn't you be able to download everything why not medicine so let's look at this wonderful 1078.19s - 1084.75s | system that's been built this is hard let's look at the easy version this is this wonderful gooey 1084.75s - 1092.51s | and you'll oh you may have seen this this is our uh little uh little captcha here so uh select 1092.51s - 1097.47s | our pharmaceutical companies which have not settled for over 500 million us dollars for 1097.47s - 1103.95s | off-label promotion and kickbacks if there are none clicks yeah yeah okay all right moving on 1105.15s - 1110.51s | you can see there are two different types of steps here one is the dark blue that's something 1110.51s - 1115.07s | that's actually automated that's something that the computer is doing then the turquoise 1116.19s - 1120.43s | that is a human step so of course the machine can't load itself full of chemicals it has to 1120.43s - 1125.55s | ask you to do that but there's a touch screen and it will talk you through that procedure it says 1125.55s - 1132.19s | at the beginning do you have the proper ingredients do you have this much is it in the solution okay 1132.19s - 1138.11s | load it into the proper syringe are you sure you're there and then the hard part for a human 1138.11s - 1144.27s | which is trying not to watch the water boil while something stirs for 18 hours and making sure that 1144.27s - 1149.39s | the temperature is just right the computer takes care of again it's a perfect division of labor the 1149.39s - 1155.87s | way most things should be so you can see we're going to scroll through this is the procedure 1155.87s - 1159.95s | for sovaldi this was the thing that we were talking about yesterday and you can see there 1159.95s - 1164.19s | are plenty of automated tasks and at the bottom there's some post-processing that has to happen 1164.19s - 1169.63s | that's done by the human that's why you see a lot of the


chunk_text:
chemicals it has to 1120.43s - 1125.55s | ask you to do that but there's a touch screen and it will talk you through that procedure it says 1125.55s - 1132.19s | at the beginning do you have the proper ingredients do you have this much is it in the solution okay 1132.19s - 1138.11s | load it into the proper syringe are you sure you're there and then the hard part for a human 1138.11s - 1144.27s | which is trying not to watch the water boil while something stirs for 18 hours and making sure that 1144.27s - 1149.39s | the temperature is just right the computer takes care of again it's a perfect division of labor the 1149.39s - 1155.87s | way most things should be so you can see we're going to scroll through this is the procedure 1155.87s - 1159.95s | for sovaldi this was the thing that we were talking about yesterday and you can see there 1159.95s - 1164.19s | are plenty of automated tasks and at the bottom there's some post-processing that has to happen 1164.19s - 1169.63s | that's done by the human that's why you see a lot of the turquoise in a row and on the right you 1169.63s - 1176.83s | can see when a particular step is selected it has parameters and you can go through and say do you 1176.83s - 1183.79s | want it to stir is it cooling or heating what temperature do we bring it to what degrees and 1183.79s - 1192.99s | for how long and it's just that easy to edit again it also supports branching this is a big deal 1192.99s - 1200.27s | because the machine is not going to know if things aren't working but the machine can ask 1200.27s - 1206.43s | you to check so let's say and this is a fairly common thing in chemistry something just doesn't 1206.43s - 1214.27s | dissolve right so you've stirred it in solvent for a long time it will say are there still particulates 1214.27s - 1219.71s | and you can then tell it yes or no and if it says yes then it will continue to stir for you and it 1219.71s - 1226.51s | says come back in another 20 minutes and let's check again so nice little linear choose your own 1226.51s - 1232.75s |


chunk_text:
turquoise in a row and on the right you 1169.63s - 1176.83s | can see when a particular step is selected it has parameters and you can go through and say do you 1176.83s - 1183.79s | want it to stir is it cooling or heating what temperature do we bring it to what degrees and 1183.79s - 1192.99s | for how long and it's just that easy to edit again it also supports branching this is a big deal 1192.99s - 1200.27s | because the machine is not going to know if things aren't working but the machine can ask 1200.27s - 1206.43s | you to check so let's say and this is a fairly common thing in chemistry something just doesn't 1206.43s - 1214.27s | dissolve right so you've stirred it in solvent for a long time it will say are there still particulates 1214.27s - 1219.71s | and you can then tell it yes or no and if it says yes then it will continue to stir for you and it 1219.71s - 1226.51s | says come back in another 20 minutes and let's check again so nice little linear choose your own 1226.51s - 1232.75s | adventure and you can build branching processes again one other thing about this that i am super 1232.75s - 1239.79s | excited about is that additionally if you have some sort of chemistry that you want to do that 1239.79s - 1244.99s | maybe isn't so complicated and doesn't even require something as sophisticated as the micro lab 1244.99s - 1249.55s | this still supports it if you just need something to talk you through a process 1250.43s - 1257.71s | and have some contingencies make sure you check xyz you can still trade ideas this way so when 1257.71s - 1262.59s | we figure things out we can tell each other and we don't even have to meet each other we can all just 1262.59s - 1270.67s | post it and be friends because i think a lot of us remember having stuff like that when we learned 1270.67s - 1276.51s | other things but somehow it's not out there for medicine and chemistry yet but it should be 1278.03s - 1283.07s | so uh this is the moment when i was going to hit the hdmi switch i'm going to instead go through 1283.71s - 1287.79s | show


chunk_text:
adventure and you can build branching processes again one other thing about this that i am super 1232.75s - 1239.79s | excited about is that additionally if you have some sort of chemistry that you want to do that 1239.79s - 1244.99s | maybe isn't so complicated and doesn't even require something as sophisticated as the micro lab 1244.99s - 1249.55s | this still supports it if you just need something to talk you through a process 1250.43s - 1257.71s | and have some contingencies make sure you check xyz you can still trade ideas this way so when 1257.71s - 1262.59s | we figure things out we can tell each other and we don't even have to meet each other we can all just 1262.59s - 1270.67s | post it and be friends because i think a lot of us remember having stuff like that when we learned 1270.67s - 1276.51s | other things but somehow it's not out there for medicine and chemistry yet but it should be 1278.03s - 1283.07s | so uh this is the moment when i was going to hit the hdmi switch i'm going to instead go through 1283.71s - 1287.79s | show you the next tool and then at the end we're going to swap to the other machine 1287.79s - 1294.51s | and we'll show the things uh live so the synthesis pathway this is the 1294.51s - 1302.51s | the this is chemhacktica this is a system that we started in 2018 i think it's gone through 1302.51s - 1310.43s | several iterations it's uh got a new kernel it's much more efficient and you can ask it whatever 1310.43s - 1314.99s | you want so for those of you who have a particular chemical you'd like us to look up this is what 1314.99s - 1319.55s | it's going to look like we're going to pull up wikipedia we're going to scroll all the way to the 1319.55s - 1327.23s | bottom we're going to go and look for the smiles code which is an open source system for encoding 1327.23s - 1333.47s | either both i should say both molecules and chemical reactions into an ascii string 1335.15s - 1342.11s | you have to click on show and it pops up you grab that you copy you paste it into chemhacktica 1342.11s - 1348.35s | and it'll draw


chunk_text:
you the next tool and then at the end we're going to swap to the other machine 1287.79s - 1294.51s | and we'll show the things uh live so the synthesis pathway this is the 1294.51s - 1302.51s | the this is chemhacktica this is a system that we started in 2018 i think it's gone through 1302.51s - 1310.43s | several iterations it's uh got a new kernel it's much more efficient and you can ask it whatever 1310.43s - 1314.99s | you want so for those of you who have a particular chemical you'd like us to look up this is what 1314.99s - 1319.55s | it's going to look like we're going to pull up wikipedia we're going to scroll all the way to the 1319.55s - 1327.23s | bottom we're going to go and look for the smiles code which is an open source system for encoding 1327.23s - 1333.47s | either both i should say both molecules and chemical reactions into an ascii string 1335.15s - 1342.11s | you have to click on show and it pops up you grab that you copy you paste it into chemhacktica 1342.11s - 1348.35s | and it'll draw the molecule for you in fact at the collective we use this just for either 1348.35s - 1354.35s | generating smiles codes or drawing things it's it's got all sorts of utility and for those of 1354.35s - 1359.23s | you who are super chemistry geeks you'll see that there are eight other modules within this as well 1360.83s - 1364.03s | typically what happens which i'm going to show you in a moment here 1364.03s - 1367.87s | is that you will just ask it to say what is the simplest way i can get from point a to point b 1369.15s - 1374.59s | but there are so many parameters that you can tweak you can say do not do anything 1375.47s - 1380.43s | that has a controlled substance as a precursor because those are hard to find 1380.43s - 1388.03s | you can say don't use any precursors that are too expensive if you want to have safety parameters 1388.03s - 1392.83s | and say don't use anything as a catalyst that's a heavy metal you can do that as well 1394.11s - 1402.91s | additionally it will hypothesize if you ask it nicely but for


chunk_text:
the molecule for you in fact at the collective we use this just for either 1348.35s - 1354.35s | generating smiles codes or drawing things it's it's got all sorts of utility and for those of 1354.35s - 1359.23s | you who are super chemistry geeks you'll see that there are eight other modules within this as well 1360.83s - 1364.03s | typically what happens which i'm going to show you in a moment here 1364.03s - 1367.87s | is that you will just ask it to say what is the simplest way i can get from point a to point b 1369.15s - 1374.59s | but there are so many parameters that you can tweak you can say do not do anything 1375.47s - 1380.43s | that has a controlled substance as a precursor because those are hard to find 1380.43s - 1388.03s | you can say don't use any precursors that are too expensive if you want to have safety parameters 1388.03s - 1392.83s | and say don't use anything as a catalyst that's a heavy metal you can do that as well 1394.11s - 1402.91s | additionally it will hypothesize if you ask it nicely but for the most part it is not doing that 1402.91s - 1407.31s | it's looking through the chemical literature all of the chemical literature that's ever been 1407.31s - 1412.11s | published and it's combinatorially looking for different pieces of the reaction that you're 1412.11s - 1418.67s | trying to create so you click on perform one step and that's basically shorthand for show me the easy 1418.67s - 1425.47s | way and when it does that it will pop up either one reaction or a series of reactions and you can 1425.47s - 1432.03s | go in and ask it to evaluate now what you see here is that one box is in blue that's your target 1432.03s - 1437.23s | those two green boxes that indicates that those are commercially available and you can just buy 1437.23s - 1442.03s | them it will come up with things that are not commercially available and those boxes will be 1442.03s - 1447.95s | red you can then click on those and say expand node which means if i can't buy this how do i 1447.95s - 1452.19s | make that thing and if you've got something terribly complicated you may have


chunk_text:
the most part it is not doing that 1402.91s - 1407.31s | it's looking through the chemical literature all of the chemical literature that's ever been 1407.31s - 1412.11s | published and it's combinatorially looking for different pieces of the reaction that you're 1412.11s - 1418.67s | trying to create so you click on perform one step and that's basically shorthand for show me the easy 1418.67s - 1425.47s | way and when it does that it will pop up either one reaction or a series of reactions and you can 1425.47s - 1432.03s | go in and ask it to evaluate now what you see here is that one box is in blue that's your target 1432.03s - 1437.23s | those two green boxes that indicates that those are commercially available and you can just buy 1437.23s - 1442.03s | them it will come up with things that are not commercially available and those boxes will be 1442.03s - 1447.95s | red you can then click on those and say expand node which means if i can't buy this how do i 1447.95s - 1452.19s | make that thing and if you've got something terribly complicated you may have to work your 1452.19s - 1456.83s | way back a ways that's the thing that says tree builder it'll do all of that automatically in 1456.83s - 1464.19s | the background if you ask it so when you click on the reaction here you see the smiles code for 1464.19s - 1470.59s | the reaction come up and it gives you a lot of parameters you can then ask it to evaluate 1470.59s - 1477.31s | and it will give you the solvents that you need the temperature at which it should work and again 1477.95s - 1486.43s | how how well it expects it to work so you can get purity and yield guesses which of course 1486.43s - 1490.67s | are dependent on conditions but it'll give you a a good guess 1492.99s - 1496.11s | this was sovaldi this was the molecule that we were talking about yesterday 1496.91s - 1501.63s | and just so you guys can see it again here's what it would look like if you found it in the 1501.63s - 1508.91s | literature this is the reaction don't get too nervous if chemistry makes you nervous we're 1508.91s - 1513.95s | starting


chunk_text:
to work your 1452.19s - 1456.83s | way back a ways that's the thing that says tree builder it'll do all of that automatically in 1456.83s - 1464.19s | the background if you ask it so when you click on the reaction here you see the smiles code for 1464.19s - 1470.59s | the reaction come up and it gives you a lot of parameters you can then ask it to evaluate 1470.59s - 1477.31s | and it will give you the solvents that you need the temperature at which it should work and again 1477.95s - 1486.43s | how how well it expects it to work so you can get purity and yield guesses which of course 1486.43s - 1490.67s | are dependent on conditions but it'll give you a a good guess 1492.99s - 1496.11s | this was sovaldi this was the molecule that we were talking about yesterday 1496.91s - 1501.63s | and just so you guys can see it again here's what it would look like if you found it in the 1501.63s - 1508.91s | literature this is the reaction don't get too nervous if chemistry makes you nervous we're 1508.91s - 1513.95s | starting one step here we asked it to do one step and it showed us a way to do it in one step 1513.95s - 1519.55s | this ring of fluorines on the right with the oxygen will break off and it will leave an empty 1519.55s - 1524.91s | space and that space where the oxygen was is going to make friends with this other oxygen on the other 1524.91s - 1532.99s | side and yes and for those of you who remember this is indeed the thing that we were trying to 1532.99s - 1540.03s | target um i'll also show you this uh those of you who were here yesterday saw this wonderful 3d 1540.59s - 1544.83s | version of it but the same thing happens the ring breaks off and then there's that 1544.83s - 1550.99s | free little stick and there's a little connection and there's your molecule 1553.39s - 1560.27s | so let's play with this i think that uh if i'm not mistaken we're at the point where we can 1561.47s - 1566.83s | switch over computers yeah this is this is getting into the biochemistry of sovaldi which 1566.83s - 1572.91s | is


chunk_text:
one step here we asked it to do one step and it showed us a way to do it in one step 1513.95s - 1519.55s | this ring of fluorines on the right with the oxygen will break off and it will leave an empty 1519.55s - 1524.91s | space and that space where the oxygen was is going to make friends with this other oxygen on the other 1524.91s - 1532.99s | side and yes and for those of you who remember this is indeed the thing that we were trying to 1532.99s - 1540.03s | target um i'll also show you this uh those of you who were here yesterday saw this wonderful 3d 1540.59s - 1544.83s | version of it but the same thing happens the ring breaks off and then there's that 1544.83s - 1550.99s | free little stick and there's a little connection and there's your molecule 1553.39s - 1560.27s | so let's play with this i think that uh if i'm not mistaken we're at the point where we can 1561.47s - 1566.83s | switch over computers yeah this is this is getting into the biochemistry of sovaldi which 1566.83s - 1572.91s | is exciting and if you want to hang out we can talk about this at the end but um i'm just going 1572.91s - 1583.55s | to switch machines real quick and see if they play nice so the thing you're about to see if i can get 1583.55s - 1594.11s | this machine to play nice is that this hopefully has a live net connection um i'm sorry um one of 1594.11s - 1598.75s | my guys is out there who said he's going to help me with this so we're actually on a live net 1598.75s - 1603.39s | connection i'm going to step out of the way while he does this we're accessing our own website 1604.19s - 1609.39s | you're going to see it happen please don't all jump on there as well like it's live you could 1609.39s - 1616.19s | but we don't know if it'll support 300 some odd people so just let us get through this and then 1616.19s - 1620.91s | and then take a look everybody cool all right thank you so bear with us for a moment while we 1620.91s - 1626.43s | try and get this thing rolling or


chunk_text:
exciting and if you want to hang out we can talk about this at the end but um i'm just going 1572.91s - 1583.55s | to switch machines real quick and see if they play nice so the thing you're about to see if i can get 1583.55s - 1594.11s | this machine to play nice is that this hopefully has a live net connection um i'm sorry um one of 1594.11s - 1598.75s | my guys is out there who said he's going to help me with this so we're actually on a live net 1598.75s - 1603.39s | connection i'm going to step out of the way while he does this we're accessing our own website 1604.19s - 1609.39s | you're going to see it happen please don't all jump on there as well like it's live you could 1609.39s - 1616.19s | but we don't know if it'll support 300 some odd people so just let us get through this and then 1616.19s - 1620.91s | and then take a look everybody cool all right thank you so bear with us for a moment while we 1620.91s - 1626.43s | try and get this thing rolling or if it's not rolling maybe my other screen is live and i can 1626.43s - 1633.20s | talk about something else while this other computer comes back to life you guys see this 1633.20s - 1640.64s | uh big bunch of ribbons here is that what's on there okay cool so just to talk about sovaldi 1640.64s - 1647.36s | real quick before we take requests and look at the system in the inside there you'll see a little 1647.36s - 1655.68s | corkscrewy thing this looks reminiscent of dna it's rna what you're looking at is part of the 1655.68s - 1664.48s | protein that sits inside of hepatitis c thank you that allows it thank you that allows it to 1664.48s - 1671.60s | replicate and that bright green bit that's sovaldi and the magic of it is that it comes in and it 1671.60s - 1678.16s | binds where one of the bases from the rna is and stops the replication in its tracks 1679.12s - 1685.68s | this is unprecedented it's amazing how it works and again it's so effective that it acts as a cure 1686.32s - 1690.80s | rather than just a treatment it


chunk_text:
if it's not rolling maybe my other screen is live and i can 1626.43s - 1633.20s | talk about something else while this other computer comes back to life you guys see this 1633.20s - 1640.64s | uh big bunch of ribbons here is that what's on there okay cool so just to talk about sovaldi 1640.64s - 1647.36s | real quick before we take requests and look at the system in the inside there you'll see a little 1647.36s - 1655.68s | corkscrewy thing this looks reminiscent of dna it's rna what you're looking at is part of the 1655.68s - 1664.48s | protein that sits inside of hepatitis c thank you that allows it thank you that allows it to 1664.48s - 1671.60s | replicate and that bright green bit that's sovaldi and the magic of it is that it comes in and it 1671.60s - 1678.16s | binds where one of the bases from the rna is and stops the replication in its tracks 1679.12s - 1685.68s | this is unprecedented it's amazing how it works and again it's so effective that it acts as a cure 1686.32s - 1690.80s | rather than just a treatment it can work and your immune system can actually catch up 1690.80s - 1697.28s | and eradicate it from your body so all right let's hope the demo gods smile on us and we're 1697.28s - 1703.52s | gonna switch over everybody ready i can't see anybody out there there could be like three 1703.52s - 1712.18s | people so like i need a little more is everybody ready awesome now we're talking so 1716.98s - 1721.14s | okay i touched it all right here we go yeah i see a little jellyfishy thing 1722.50s - 1729.70s | okay cool i lost i lost my screen well it'll all right so here we'll just do this from scratch 1729.70s - 1734.10s | here we go so here's chemactica oh switch the tab i just minimize it where is it 1734.98s - 1742.02s | i lost it all right never mind i'll do a fresh one here we go come on you can do it 1744.18s - 1746.66s | maybe you can't do it we had it a second ago 1748.98s - 1757.86s | uh dude okay i'm i'm struggling here so uh again as soon as this comes back up you'll


chunk_text:
can work and your immune system can actually catch up 1690.80s - 1697.28s | and eradicate it from your body so all right let's hope the demo gods smile on us and we're 1697.28s - 1703.52s | gonna switch over everybody ready i can't see anybody out there there could be like three 1703.52s - 1712.18s | people so like i need a little more is everybody ready awesome now we're talking so 1716.98s - 1721.14s | okay i touched it all right here we go yeah i see a little jellyfishy thing 1722.50s - 1729.70s | okay cool i lost i lost my screen well it'll all right so here we'll just do this from scratch 1729.70s - 1734.10s | here we go so here's chemactica oh switch the tab i just minimize it where is it 1734.98s - 1742.02s | i lost it all right never mind i'll do a fresh one here we go come on you can do it 1744.18s - 1746.66s | maybe you can't do it we had it a second ago 1748.98s - 1757.86s | uh dude okay i'm i'm struggling here so uh again as soon as this comes back up you'll see that 1757.86s - 1762.58s | same screen that i showed a second ago i'm just taking this out okay there that's a little better 1762.58s - 1766.34s | can you guys hear me better this way all right cool thanks i'm just gonna do this i'm more 1766.34s - 1774.34s | comfortable with it i don't know how i dropped the thing so you'll be faced with a page and it'll 1774.34s - 1783.70s | have a there it is yeah cool can you guys see it all right cool it's uh the aspect ratio is a little 1783.70s - 1791.46s | weird but here's what we're gonna do um we're gonna grab wikipedia here and we're just gonna 1791.46s - 1798.50s | look for your drug of choice and um again soon i'll get a stack of your requests but 1800.10s - 1803.94s | there you go um and i'll just do sovaldi um 1808.58s - 1811.70s | i'm typing in the dark but let's see if it'll search 1815.70s - 1819.86s | you know this makes me so nostalgic for when i was a kid and we had 1819.86s - 1827.06s | dial-up modems um so yeah


chunk_text:
see that 1757.86s - 1762.58s | same screen that i showed a second ago i'm just taking this out okay there that's a little better 1762.58s - 1766.34s | can you guys hear me better this way all right cool thanks i'm just gonna do this i'm more 1766.34s - 1774.34s | comfortable with it i don't know how i dropped the thing so you'll be faced with a page and it'll 1774.34s - 1783.70s | have a there it is yeah cool can you guys see it all right cool it's uh the aspect ratio is a little 1783.70s - 1791.46s | weird but here's what we're gonna do um we're gonna grab wikipedia here and we're just gonna 1791.46s - 1798.50s | look for your drug of choice and um again soon i'll get a stack of your requests but 1800.10s - 1803.94s | there you go um and i'll just do sovaldi um 1808.58s - 1811.70s | i'm typing in the dark but let's see if it'll search 1815.70s - 1819.86s | you know this makes me so nostalgic for when i was a kid and we had 1819.86s - 1827.06s | dial-up modems um so yeah i'm not sure how viable this is going to be at this juncture 1827.70s - 1833.14s | um so while this is loading i'm just going to switch gears uh who has my note cards 1836.29s - 1845.39s | okay we just passed me some sending a request to intake dash analytics wikimedia.org 1846.35s - 1857.63s | this may or may not be a slow process but okay cool all right so um i'm gonna start with looking 1857.63s - 1865.31s | at some of the drug requests somebody says testosterone please um yeah that's a hormone 1866.11s - 1872.19s | doable can we synthesize estradiol i'm sensing a pattern okay 1875.55s - 1881.71s | ah vivance somebody here was nice enough to actually point out that there are some problems 1881.71s - 1887.31s | with this even after the patent has expired last year i still have to pay two hundred dollars a 1887.31s - 1899.55s | month yeah that sounds fucked let's let's maybe fix that all right this one i don't know uh 1899.55s - 1905.87s | mometasane furry treats asthma and eczema so i don't know so one thing um yesterday somebody 1905.87s - 1910.27s |


chunk_text:
i'm not sure how viable this is going to be at this juncture 1827.70s - 1833.14s | um so while this is loading i'm just going to switch gears uh who has my note cards 1836.29s - 1845.39s | okay we just passed me some sending a request to intake dash analytics wikimedia.org 1846.35s - 1857.63s | this may or may not be a slow process but okay cool all right so um i'm gonna start with looking 1857.63s - 1865.31s | at some of the drug requests somebody says testosterone please um yeah that's a hormone 1866.11s - 1872.19s | doable can we synthesize estradiol i'm sensing a pattern okay 1875.55s - 1881.71s | ah vivance somebody here was nice enough to actually point out that there are some problems 1881.71s - 1887.31s | with this even after the patent has expired last year i still have to pay two hundred dollars a 1887.31s - 1899.55s | month yeah that sounds fucked let's let's maybe fix that all right this one i don't know uh 1899.55s - 1905.87s | mometasane furry treats asthma and eczema so i don't know so one thing um yesterday somebody 1905.87s - 1910.27s | came up and asked me about monoclonal antibodies i'm sure a lot of you have seen monoclonal 1910.27s - 1917.87s | antibodies in the news they are this miracle thing unfortunately they are too complicated 1917.87s - 1922.27s | for us to do it's a macromolecule they're gigantic the way that you manufacture them 1922.27s - 1928.51s | is not the same as small molecule chemistry a rough idea is if you can write it on a napkin 1929.23s - 1936.19s | then you can probably do it over here if it's big not so much so uh 1938.43s - 1944.59s | can you get time release capsules for slow relapse meds yes so that's in the compounding 1944.59s - 1949.95s | phase there are plenty of um ways to do that there's some really cool stuff the 1950.67s - 1956.03s | interestingly enough i'm going to hazard a guess this is somebody who wants adderall xl okay like 1956.03s - 1965.31s | just maybe not but in the case that you do here is a trick the way that adderall xl is manufactured 1965.31s - 1969.47s | is that there are those tiny little spheres that are inside the


chunk_text:
came up and asked me about monoclonal antibodies i'm sure a lot of you have seen monoclonal 1910.27s - 1917.87s | antibodies in the news they are this miracle thing unfortunately they are too complicated 1917.87s - 1922.27s | for us to do it's a macromolecule they're gigantic the way that you manufacture them 1922.27s - 1928.51s | is not the same as small molecule chemistry a rough idea is if you can write it on a napkin 1929.23s - 1936.19s | then you can probably do it over here if it's big not so much so uh 1938.43s - 1944.59s | can you get time release capsules for slow relapse meds yes so that's in the compounding 1944.59s - 1949.95s | phase there are plenty of um ways to do that there's some really cool stuff the 1950.67s - 1956.03s | interestingly enough i'm going to hazard a guess this is somebody who wants adderall xl okay like 1956.03s - 1965.31s | just maybe not but in the case that you do here is a trick the way that adderall xl is manufactured 1965.31s - 1969.47s | is that there are those tiny little spheres that are inside the capsule and half of them 1969.47s - 1974.83s | are coated and half of them are not coated it just means that some of those dissolve 1974.83s - 1981.71s | instantaneously and some of them don't it is designed not just practically it is designed 1981.71s - 1988.03s | specifically only to be the same as taking half of one and then taking the other half four hours 1988.03s - 1999.18s | later so best time release system look at your watch can you make insulin oh my god isn't this 1999.18s - 2006.22s | a fucker of all times man so yeah we're super angry about that one too uh insulin is something 2006.22s - 2013.18s | you have to sort of bioproduce you can do it what we're trying to do right now actually as we speak 2014.14s - 2022.78s | is replicate a system by which tobacco will manufacture incident endogenously now you can't 2022.78s - 2030.38s | smoke it but you can dip it um this has been demonstrated to work we're just trying to 2030.38s - 2034.54s | steal it because it's not commercially available but imagine you just grow some 2034.54s - 2039.98s |


chunk_text:
capsule and half of them 1969.47s - 1974.83s | are coated and half of them are not coated it just means that some of those dissolve 1974.83s - 1981.71s | instantaneously and some of them don't it is designed not just practically it is designed 1981.71s - 1988.03s | specifically only to be the same as taking half of one and then taking the other half four hours 1988.03s - 1999.18s | later so best time release system look at your watch can you make insulin oh my god isn't this 1999.18s - 2006.22s | a fucker of all times man so yeah we're super angry about that one too uh insulin is something 2006.22s - 2013.18s | you have to sort of bioproduce you can do it what we're trying to do right now actually as we speak 2014.14s - 2022.78s | is replicate a system by which tobacco will manufacture incident endogenously now you can't 2022.78s - 2030.38s | smoke it but you can dip it um this has been demonstrated to work we're just trying to 2030.38s - 2034.54s | steal it because it's not commercially available but imagine you just grow some 2034.54s - 2039.98s | tobacco in your backyard and insulin's free just like in that old tweet 2040.30s - 2048.37s | we put it too bad do any reactions require cooling yes absolutely are you working on that 2048.37s - 2053.57s | no we already worked on it so if you look at the machine you'll see this thing under the foil that's 2053.57s - 2058.45s | the cooling side there are two things that circulate there's a heating module and there's 2058.45s - 2063.49s | a cooling module often you have to keep things cool if you have an exothermic reaction that's 2063.49s - 2067.33s | going to not be happy when it gets too hot you have to keep it cool so you will have a system 2067.33s - 2075.41s | that has either ice and water or ice and acetone or ice and isopropyl alcohol and these will give 2075.41s - 2080.21s | you different set points that will be able to control your temperature oh look this came up 2080.21s - 2084.85s | all right cool is everybody cool with this and i'm sort of going back and forth and answering 2084.85s - 2089.81s | questions as we go all


chunk_text:
tobacco in your backyard and insulin's free just like in that old tweet 2040.30s - 2048.37s | we put it too bad do any reactions require cooling yes absolutely are you working on that 2048.37s - 2053.57s | no we already worked on it so if you look at the machine you'll see this thing under the foil that's 2053.57s - 2058.45s | the cooling side there are two things that circulate there's a heating module and there's 2058.45s - 2063.49s | a cooling module often you have to keep things cool if you have an exothermic reaction that's 2063.49s - 2067.33s | going to not be happy when it gets too hot you have to keep it cool so you will have a system 2067.33s - 2075.41s | that has either ice and water or ice and acetone or ice and isopropyl alcohol and these will give 2075.41s - 2080.21s | you different set points that will be able to control your temperature oh look this came up 2080.21s - 2084.85s | all right cool is everybody cool with this and i'm sort of going back and forth and answering 2084.85s - 2089.81s | questions as we go all right cool thank you i appreciate the encouragement again it's so dark 2089.81s - 2097.01s | it looks like i'm here alone could you make injectable medications like insulin or humira 2098.21s - 2104.85s | so this again is a question not so much of manufacturing of the actual molecule but in 2104.85s - 2110.69s | terms of compounding you can make injectable meds you take that powder you can put it into 2110.69s - 2118.05s | injectable form if you do that please be careful when you swallow a pill if it's a little dirty 2118.05s - 2123.33s | it's not going to be that great if you take a needle that's dirty or a fluid that's dirty and 2123.33s - 2131.33s | inject it into oh god did i break it again let's hope it comes back all right i'll need somebody 2131.33s - 2138.77s | to log me back in um if you're compounding things for injection you have to practice sterile 2138.77s - 2143.49s | technique now this is totally doable okay i don't want to scare anybody and say don't do it 2144.05s - 2149.57s | be careful no be competent you can learn sterile


chunk_text:
right cool thank you i appreciate the encouragement again it's so dark 2089.81s - 2097.01s | it looks like i'm here alone could you make injectable medications like insulin or humira 2098.21s - 2104.85s | so this again is a question not so much of manufacturing of the actual molecule but in 2104.85s - 2110.69s | terms of compounding you can make injectable meds you take that powder you can put it into 2110.69s - 2118.05s | injectable form if you do that please be careful when you swallow a pill if it's a little dirty 2118.05s - 2123.33s | it's not going to be that great if you take a needle that's dirty or a fluid that's dirty and 2123.33s - 2131.33s | inject it into oh god did i break it again let's hope it comes back all right i'll need somebody 2131.33s - 2138.77s | to log me back in um if you're compounding things for injection you have to practice sterile 2138.77s - 2143.49s | technique now this is totally doable okay i don't want to scare anybody and say don't do it 2144.05s - 2149.57s | be careful no be competent you can learn sterile technique but it is something that requires 2150.53s - 2157.89s | attention here's an example right standard of practice for sterile sterility training 2158.61s - 2163.65s | your hands don't leave your line of sight or you've broken sterility and here my hands haven't 2163.65s - 2170.21s | touched anything and then you adjust your glasses and it's over so a real easy lot of mistakes to 2170.29s - 2181.73s | make okay okay so that tells me i'm good benzo natate i'm gonna guess that's a like a valium 2182.45s - 2189.89s | type thing okay yeah um i'm not sure but again if it's a small molecule probably doable somebody 2189.89s - 2198.10s | else is asking about vivance all right cool we got more stuff all right cool a lot of people 2198.10s - 2204.18s | asking about vivance oh modafinil if somebody just wants one now just ask me i think i have 2204.18s - 2210.18s | one in my pocket here somewhere okay cool so let's uh so here i will skip over here and now 2210.18s - 2215.30s | that wikipedia is making friends let's look at vivance since so many people are asking


chunk_text:
technique but it is something that requires 2150.53s - 2157.89s | attention here's an example right standard of practice for sterile sterility training 2158.61s - 2163.65s | your hands don't leave your line of sight or you've broken sterility and here my hands haven't 2163.65s - 2170.21s | touched anything and then you adjust your glasses and it's over so a real easy lot of mistakes to 2170.29s - 2181.73s | make okay okay so that tells me i'm good benzo natate i'm gonna guess that's a like a valium 2182.45s - 2189.89s | type thing okay yeah um i'm not sure but again if it's a small molecule probably doable somebody 2189.89s - 2198.10s | else is asking about vivance all right cool we got more stuff all right cool a lot of people 2198.10s - 2204.18s | asking about vivance oh modafinil if somebody just wants one now just ask me i think i have 2204.18s - 2210.18s | one in my pocket here somewhere okay cool so let's uh so here i will skip over here and now 2210.18s - 2215.30s | that wikipedia is making friends let's look at vivance since so many people are asking about it 2215.30s - 2223.70s | by vans is that the correct spelling by van there's an n in there right vans by vans that correct 2224.66s - 2233.30s | all right let's give that a try yeah okay cool all right thank you all right um 2235.30s - 2242.50s | all right okay our hot spot apparently went down all right we've got uh more questions i am a 2242.50s - 2249.38s | software engineer in a med school dropout how can i help contribute come say hi where are you my god 2249.38s - 2256.66s | come make friends and like i'm serious i know that a lot of times people will come up on stages 2256.66s - 2260.66s | like this and say no we really want help from anybody it doesn't matter your skill set we can 2260.66s - 2268.18s | use the help i'm not lying about that seriously if you say i have no technical skills i'm at 2268.18s - 2274.10s | defcon because somebody dragged me and i don't know how to use my smartphone but this seems cool 2274.18s - 2282.98s | seriously come fucking say hi we need all of you


chunk_text:
about it 2215.30s - 2223.70s | by vans is that the correct spelling by van there's an n in there right vans by vans that correct 2224.66s - 2233.30s | all right let's give that a try yeah okay cool all right thank you all right um 2235.30s - 2242.50s | all right okay our hot spot apparently went down all right we've got uh more questions i am a 2242.50s - 2249.38s | software engineer in a med school dropout how can i help contribute come say hi where are you my god 2249.38s - 2256.66s | come make friends and like i'm serious i know that a lot of times people will come up on stages 2256.66s - 2260.66s | like this and say no we really want help from anybody it doesn't matter your skill set we can 2260.66s - 2268.18s | use the help i'm not lying about that seriously if you say i have no technical skills i'm at 2268.18s - 2274.10s | defcon because somebody dragged me and i don't know how to use my smartphone but this seems cool 2274.18s - 2282.98s | seriously come fucking say hi we need all of you no joke oh there you are yes especially you 2285.06s - 2292.66s | all right do you have more business cards all right yes 2294.90s - 2299.62s | but this is the important thing yes we have a bunch of business cards if you want some 2299.62s - 2304.42s | yeah i'll pass them to you but the big deal is not that we made business cards the big deal is 2304.42s - 2310.58s | that you can make business cards it's really really easy six dots on a piece of paper let 2310.58s - 2318.02s | it dry and put it in a bag there is a not a person here who can't do that so you want a business card 2318.66s - 2326.90s | come get one please make a bunch with your friends and if you have some anarchist collective or a 2326.90s - 2332.58s | bunch of geeky friends who are hanging out somewhere and you want let me know i'll come by 2332.58s - 2337.14s | and do a workshop and we can all just hang out at each other's houses and make abortion cards 2337.14s - 2340.98s | does that sound like a good


chunk_text:
no joke oh there you are yes especially you 2285.06s - 2292.66s | all right do you have more business cards all right yes 2294.90s - 2299.62s | but this is the important thing yes we have a bunch of business cards if you want some 2299.62s - 2304.42s | yeah i'll pass them to you but the big deal is not that we made business cards the big deal is 2304.42s - 2310.58s | that you can make business cards it's really really easy six dots on a piece of paper let 2310.58s - 2318.02s | it dry and put it in a bag there is a not a person here who can't do that so you want a business card 2318.66s - 2326.90s | come get one please make a bunch with your friends and if you have some anarchist collective or a 2326.90s - 2332.58s | bunch of geeky friends who are hanging out somewhere and you want let me know i'll come by 2332.58s - 2337.14s | and do a workshop and we can all just hang out at each other's houses and make abortion cards 2337.14s - 2340.98s | does that sound like a good plan all right call me 2346.24s - 2353.71s | ah there was a second part to this question about purity and dose determining yeah so 2354.67s - 2362.75s | the thing that's the thing that's hard for most people who have seen modern chemistry to really 2362.75s - 2368.75s | grok is that it's entirely possible oh we got live ants oh look at that all right cool is that you 2368.75s - 2377.71s | don't need all the fancy machinery you know you talk to people who work in chemistry and they 2378.27s - 2386.67s | talk about things like high-performance liquid chromatography gas chromatographs uh nmrs all 2386.67s - 2391.15s | right so you see this milestone thing here i i think it's against crawlers but you've got to 2391.15s - 2397.55s | click to show and then you grab it like this and if i can just doop doop doop and then let's click 2397.55s - 2408.83s | over so here we are let's click this in here we'll do a little paste and may take a minute 2408.83s - 2416.75s | again it's querying a machine that's very far away um but wet chemistry has been


chunk_text:
plan all right call me 2346.24s - 2353.71s | ah there was a second part to this question about purity and dose determining yeah so 2354.67s - 2362.75s | the thing that's the thing that's hard for most people who have seen modern chemistry to really 2362.75s - 2368.75s | grok is that it's entirely possible oh we got live ants oh look at that all right cool is that you 2368.75s - 2377.71s | don't need all the fancy machinery you know you talk to people who work in chemistry and they 2378.27s - 2386.67s | talk about things like high-performance liquid chromatography gas chromatographs uh nmrs all 2386.67s - 2391.15s | right so you see this milestone thing here i i think it's against crawlers but you've got to 2391.15s - 2397.55s | click to show and then you grab it like this and if i can just doop doop doop and then let's click 2397.55s - 2408.83s | over so here we are let's click this in here we'll do a little paste and may take a minute 2408.83s - 2416.75s | again it's querying a machine that's very far away um but wet chemistry has been done for hundreds 2416.75s - 2420.91s | and hundreds of years way before there were electronic machines to check our work there are 2420.91s - 2426.99s | plenty of ways to check for purity the simplest one is called a steel tube it's a little piece 2426.99s - 2432.99s | of glass that's a loop and then you take a tiny little thing that looks like a miniature 2434.27s - 2441.31s | um test tube from like a dollhouse you stick it in and then you start heating it and then you'll 2441.31s - 2447.55s | see your powder turn from powder to liquid and most things have sharp melting points and if they 2447.55s - 2454.43s | melt at the temperature that you expect you know that it works and if it's off you can do a little 2454.43s - 2459.39s | interpolation just a little ratio don't get scared by the math it's just a ratio seriously 2461.07s - 2465.07s | and you can calculate your purity i'm gonna try and click and see if it'll bounce over 2465.71s - 2473.71s | um in the meantime i will go back everybody's still cool i know this is like


chunk_text:
done for hundreds 2416.75s - 2420.91s | and hundreds of years way before there were electronic machines to check our work there are 2420.91s - 2426.99s | plenty of ways to check for purity the simplest one is called a steel tube it's a little piece 2426.99s - 2432.99s | of glass that's a loop and then you take a tiny little thing that looks like a miniature 2434.27s - 2441.31s | um test tube from like a dollhouse you stick it in and then you start heating it and then you'll 2441.31s - 2447.55s | see your powder turn from powder to liquid and most things have sharp melting points and if they 2447.55s - 2454.43s | melt at the temperature that you expect you know that it works and if it's off you can do a little 2454.43s - 2459.39s | interpolation just a little ratio don't get scared by the math it's just a ratio seriously 2461.07s - 2465.07s | and you can calculate your purity i'm gonna try and click and see if it'll bounce over 2465.71s - 2473.71s | um in the meantime i will go back everybody's still cool i know this is like just so dramatic 2473.71s - 2480.99s | we're gonna figure it out but like you know if um if you're on a regular uh net connection it 2480.99s - 2488.67s | just pops up it takes like half a minute sometimes depending on how uh complicated okay what cad 2488.67s - 2499.79s | software does the team use i haven't the foggiest idea um somebody knows yeah free cad all right 2499.79s - 2511.89s | moving on um this is still working maybe i click it again here you fiddle with that okay 2512.53s - 2519.81s | would it be different to get these equipment through airports sending or across national 2519.81s - 2530.29s | or international borders um so this all came from very far away yeah uh east coast uh we 2531.41s - 2536.29s | i mean not that our people aren't super experienced in smuggling they are but 2536.29s - 2540.45s | those skills were not required for this people typically don't give you shit it's it's just a 2540.45s - 2545.33s | bunch of computer stuff they might ask but it's not it's not that weird international 2545.33s - 2556.42s | borders slightly different thing um


chunk_text:
just so dramatic 2473.71s - 2480.99s | we're gonna figure it out but like you know if um if you're on a regular uh net connection it 2480.99s - 2488.67s | just pops up it takes like half a minute sometimes depending on how uh complicated okay what cad 2488.67s - 2499.79s | software does the team use i haven't the foggiest idea um somebody knows yeah free cad all right 2499.79s - 2511.89s | moving on um this is still working maybe i click it again here you fiddle with that okay 2512.53s - 2519.81s | would it be different to get these equipment through airports sending or across national 2519.81s - 2530.29s | or international borders um so this all came from very far away yeah uh east coast uh we 2531.41s - 2536.29s | i mean not that our people aren't super experienced in smuggling they are but 2536.29s - 2540.45s | those skills were not required for this people typically don't give you shit it's it's just a 2540.45s - 2545.33s | bunch of computer stuff they might ask but it's not it's not that weird international 2545.33s - 2556.42s | borders slightly different thing um i can't talk about it in public but there are maybe some war 2556.42s - 2560.34s | zones that you've read about in the news where you've been trying to move things you can get 2560.34s - 2566.90s | them across so we're trying to do our bit that way and if you're doing that it's doable sorry i can't 2566.98s - 2570.74s | be more specific in public lest i be dragged away before the talk ends 2574.66s - 2581.38s | everybody's still cool all right thank you is there a crowdsource community for tackling a 2581.38s - 2588.42s | procedure as a group oh my fucking god there should be now here's the thing there are two 2588.42s - 2595.78s | subreddits that are like super sleepy um i believe one's called like they both have something like 2595.78s - 2601.38s | biohacking in the title and there's not much going on there what we would love to see happen 2601.38s - 2608.82s | is this start now whoever wrote this question please help us start this i'm not kidding this 2608.82s - 2615.38s | keeps me up at night because all of this stuff that we do


chunk_text:
i can't talk about it in public but there are maybe some war 2556.42s - 2560.34s | zones that you've read about in the news where you've been trying to move things you can get 2560.34s - 2566.90s | them across so we're trying to do our bit that way and if you're doing that it's doable sorry i can't 2566.98s - 2570.74s | be more specific in public lest i be dragged away before the talk ends 2574.66s - 2581.38s | everybody's still cool all right thank you is there a crowdsource community for tackling a 2581.38s - 2588.42s | procedure as a group oh my fucking god there should be now here's the thing there are two 2588.42s - 2595.78s | subreddits that are like super sleepy um i believe one's called like they both have something like 2595.78s - 2601.38s | biohacking in the title and there's not much going on there what we would love to see happen 2601.38s - 2608.82s | is this start now whoever wrote this question please help us start this i'm not kidding this 2608.82s - 2615.38s | keeps me up at night because all of this stuff that we do if now don't get me wrong i am so 2615.38s - 2619.62s | grateful that all 300 of you are here but if we are the only people who figure out how to do this 2620.34s - 2625.22s | we've failed so please let's figure out a way to talk about it if somebody has a way to generate a 2625.22s - 2630.58s | subreddit or just create a thread where things are popping a little more that would be spectacular 2631.86s - 2639.46s | um any looking at ozempic wagovi fuck no you shouldn't be taking that shit leave it for 2639.46s - 2647.58s | people who actually have diabetes i'm sorry also you don't want your retinas to detach 2647.58s - 2655.98s | it's not a good look ah i was anticipating question this question are you still working 2655.98s - 2662.46s | on the mouth bacteria how many people know what this is in reference to okay short answer 2663.74s - 2670.14s | yeah it's done we still need to change one last thing but it functions properly so it's going to 2670.14s - 2676.78s | be probably a couple of months before we actually release it


chunk_text:
if now don't get me wrong i am so 2615.38s - 2619.62s | grateful that all 300 of you are here but if we are the only people who figure out how to do this 2620.34s - 2625.22s | we've failed so please let's figure out a way to talk about it if somebody has a way to generate a 2625.22s - 2630.58s | subreddit or just create a thread where things are popping a little more that would be spectacular 2631.86s - 2639.46s | um any looking at ozempic wagovi fuck no you shouldn't be taking that shit leave it for 2639.46s - 2647.58s | people who actually have diabetes i'm sorry also you don't want your retinas to detach 2647.58s - 2655.98s | it's not a good look ah i was anticipating question this question are you still working 2655.98s - 2662.46s | on the mouth bacteria how many people know what this is in reference to okay short answer 2663.74s - 2670.14s | yeah it's done we still need to change one last thing but it functions properly so it's going to 2670.14s - 2676.78s | be probably a couple of months before we actually release it and i'm getting a notion that this is 2676.78s - 2684.30s | all toast so here's the thing go to synth.forthesvinegar.org and you can just do the 2684.30s - 2690.70s | thing that i did and you'll see that it works it's really impressive i'm sorry i couldn't show it to 2690.70s - 2698.70s | you live but i will answer a few more questions and mention one other thing how do you plan to 2698.70s - 2709.02s | keep chemhactica up to date well that's a fair question um it does work within the ecosystem 2709.02s - 2715.50s | of open source software there are we're sort of maintaining one fork the heavy lifting was done 2715.50s - 2723.10s | by some other people um but there isn't a whole lot to update really it does crawl through a 2723.10s - 2731.10s | database called reaxis and any time that you recompile if you use that database or i don't 2731.10s - 2734.86s | think you even have to recompile you just have to point it to the updated version of reaxis and 2734.86s - 2747.18s | that should do it itself um with the rise of ai oh


chunk_text:
and i'm getting a notion that this is 2676.78s - 2684.30s | all toast so here's the thing go to synth.forthesvinegar.org and you can just do the 2684.30s - 2690.70s | thing that i did and you'll see that it works it's really impressive i'm sorry i couldn't show it to 2690.70s - 2698.70s | you live but i will answer a few more questions and mention one other thing how do you plan to 2698.70s - 2709.02s | keep chemhactica up to date well that's a fair question um it does work within the ecosystem 2709.02s - 2715.50s | of open source software there are we're sort of maintaining one fork the heavy lifting was done 2715.50s - 2723.10s | by some other people um but there isn't a whole lot to update really it does crawl through a 2723.10s - 2731.10s | database called reaxis and any time that you recompile if you use that database or i don't 2731.10s - 2734.86s | think you even have to recompile you just have to point it to the updated version of reaxis and 2734.86s - 2747.18s | that should do it itself um with the rise of ai oh oh would you utilize ai to make your device 2747.18s - 2755.58s | better do you think it would make it better i mean i know mansplaining as a service is real 2755.58s - 2762.70s | popular these days but kind of a bad look um no okay but in all seriousness we have been looking 2762.70s - 2769.42s | at trying to build some systems that will help you navigate the scientific literature because 2769.42s - 2773.90s | taking technical jargon and boiling it down is something that the large language models seem to 2773.90s - 2780.46s | be good at but we've been having trouble trying to get it to work because it makes shit up um 2780.46s - 2786.38s | oh my goodness all right i know there are still more here i i got a five minute mark let me say 2786.38s - 2800.42s | one more thing before i step off stage here if this work seems worthwhile to you or interesting 2801.30s - 2812.90s | or fun come join us we need your help we need it now think for a moment if i were to say somebody's 2812.90s - 2817.46s | dying outside


chunk_text:
oh would you utilize ai to make your device 2747.18s - 2755.58s | better do you think it would make it better i mean i know mansplaining as a service is real 2755.58s - 2762.70s | popular these days but kind of a bad look um no okay but in all seriousness we have been looking 2762.70s - 2769.42s | at trying to build some systems that will help you navigate the scientific literature because 2769.42s - 2773.90s | taking technical jargon and boiling it down is something that the large language models seem to 2773.90s - 2780.46s | be good at but we've been having trouble trying to get it to work because it makes shit up um 2780.46s - 2786.38s | oh my goodness all right i know there are still more here i i got a five minute mark let me say 2786.38s - 2800.42s | one more thing before i step off stage here if this work seems worthwhile to you or interesting 2801.30s - 2812.90s | or fun come join us we need your help we need it now think for a moment if i were to say somebody's 2812.90s - 2817.46s | dying outside and you can help me save them i just need you to come with me and help me 2817.46s - 2824.42s | you do it and if i say now that if you write me an email and we start working together that we 2824.42s - 2830.42s | could save millions why wouldn't you do that and you don't even have to join us to join us 2830.42s - 2836.82s | just build your own figure out things that we didn't use it for procedures that we didn't 2837.54s - 2844.42s | think of make it better make it new and teach people there's no better thing that you can do 2844.42s - 2851.14s | as a technically adept person than to teach what you know to somebody who doesn't know it yet 2852.90s - 2858.42s | we can make things so much better all of us together please come chat with me after 2858.98s - 2863.94s | write to us or don't and just make it yourself thank you all so much for coming


chunk_text:
and you can help me save them i just need you to come with me and help me 2817.46s - 2824.42s | you do it and if i say now that if you write me an email and we start working together that we 2824.42s - 2830.42s | could save millions why wouldn't you do that and you don't even have to join us to join us 2830.42s - 2836.82s | just build your own figure out things that we didn't use it for procedures that we didn't 2837.54s - 2844.42s | think of make it better make it new and teach people there's no better thing that you can do 2844.42s - 2851.14s | as a technically adept person than to teach what you know to somebody who doesn't know it yet 2852.90s - 2858.42s | we can make things so much better all of us together please come chat with me after 2858.98s - 2863.94s | write to us or don't and just make it yourself thank you all so much for coming


chunk_text:
{ "webpage_url": "https://www.youtube.com/watch?v=OkVNbL7gysI", "title": "DEF CON 32 - How we built our REDACTED THING this year, 5n4ck3y, && AMA Badge Panel - AND!XOR", "description": "See talk title, kids these days dont read more than a sentence anyway. Seriously though, we get asked a lot of random custom electronics, hardware hacking, and badge questions, here's your chance to throw them at us while we drink a beer and pretend to know the right answer", "channel_url": "https://www.youtube.com/channel/UC6Om9kAkl32dWlDSNlDS9Iw", "duration": 2450, "channel": "DEFCONConference", "uploader": "DEFCONConference", "upload_date": "20241016" } 0.00s - 4.88s | This text was transcribed using whisper model: large-v2 So, we're going to talk about how we built our redacted Anodic Sower Badge this year. 7.28s - 10.16s | Oh, really? I should start with, can you hear me all right? 11.28s - 16.96s | Now we're golden. And feel free to come closer if you want to ask questions and whatnot. 17.60s - 20.56s | So yeah, we're going to go over how we did our Anodic Sower Badge this year, 20.56s - 26.08s | all the fun and challenges we ran into, and reverse engineering snack machines. 26.32s - 26.88s | First challenge. 29.68s - 34.64s | Now it's off. We're dying. We've lost mics. 35.84s - 42.16s | No. Does the mic run on Cox internet? All right. 42.16s - 45.28s | Our first challenge that we have already that we have a problem is, 45.28s - 47.28s | it says three people, it's two now. 47.28s - 53.68s | Yeah. I'm higher on. This is, yeah. Zap's taking care of the snack machine. 54.16s - 58.48s | So of course, normal disclaimer, this is our fun side thing. 58.48s - 60.48s | We have employers like most people do. 60.48s - 62.24s | This does not represent our employers. 62.24s - 65.36s | But more importantly, this is a community stage. 65.36s - 68.00s | And we didn't really want to give a talk. 68.00s - 70.40s | We wanted to treat it like community discussion. 70.40s - 73.60s | When we're running our contest, tons of people want to talk to us about, 73.60s - 77.76s | hey, what was it like making the badge, working with Snacky, doing different things. 77.76s - 81.20s | And you feel bad because you want to have deep conversations about this stuff. 81.76s - 87.44s | But you're also running a


chunk_text:
dying. We've lost mics. 35.84s - 42.16s | No. Does the mic run on Cox internet? All right. 42.16s - 45.28s | Our first challenge that we have already that we have a problem is, 45.28s - 47.28s | it says three people, it's two now. 47.28s - 53.68s | Yeah. I'm higher on. This is, yeah. Zap's taking care of the snack machine. 54.16s - 58.48s | So of course, normal disclaimer, this is our fun side thing. 58.48s - 60.48s | We have employers like most people do. 60.48s - 62.24s | This does not represent our employers. 62.24s - 65.36s | But more importantly, this is a community stage. 65.36s - 68.00s | And we didn't really want to give a talk. 68.00s - 70.40s | We wanted to treat it like community discussion. 70.40s - 73.60s | When we're running our contest, tons of people want to talk to us about, 73.60s - 77.76s | hey, what was it like making the badge, working with Snacky, doing different things. 77.76s - 81.20s | And you feel bad because you want to have deep conversations about this stuff. 81.76s - 87.44s | But you're also running a contest with six, seven, 800 people running around and things breaking. 87.44s - 91.76s | So don't treat this as a talk. Treat it like a town hall. 91.76s - 94.56s | You know, politely interrupt us, ask questions. 94.56s - 101.20s | I'll do my best to like hear and repeat it back so others can hear it and group discussion. 101.20s - 103.28s | But we'll, we'll use the slides to go through it. 103.28s - 106.88s | And anytime you're curious about something, ask. 107.28s - 107.84s | Same thing? 107.84s - 109.20s | Oh, that's good. 109.20s - 109.76s | All right. 111.12s - 113.04s | So we're Anodic Zor. 113.04s - 115.52s | We've been making badges for about nine years. 116.56s - 118.40s | Different members have come in and out. 118.40s - 123.60s | But if you take a look at the picture, you can see a lot of the different work we've done over the years. 123.60s - 127.76s | And yeah, we joke, we make stuff, drink beer, no particular order. 128.32s - 130.64s | We just have a wide variety of backgrounds. 130.64s - 134.96s | And we like doing


chunk_text:
contest with six, seven, 800 people running around and things breaking. 87.44s - 91.76s | So don't treat this as a talk. Treat it like a town hall. 91.76s - 94.56s | You know, politely interrupt us, ask questions. 94.56s - 101.20s | I'll do my best to like hear and repeat it back so others can hear it and group discussion. 101.20s - 103.28s | But we'll, we'll use the slides to go through it. 103.28s - 106.88s | And anytime you're curious about something, ask. 107.28s - 107.84s | Same thing? 107.84s - 109.20s | Oh, that's good. 109.20s - 109.76s | All right. 111.12s - 113.04s | So we're Anodic Zor. 113.04s - 115.52s | We've been making badges for about nine years. 116.56s - 118.40s | Different members have come in and out. 118.40s - 123.60s | But if you take a look at the picture, you can see a lot of the different work we've done over the years. 123.60s - 127.76s | And yeah, we joke, we make stuff, drink beer, no particular order. 128.32s - 130.64s | We just have a wide variety of backgrounds. 130.64s - 134.96s | And we like doing this as a fun, interesting way to get people involved. 135.28s - 138.72s | And I guess that's like, hey, why do we do this to ourselves? 138.72s - 142.00s | Because you'll hear people, you know, joke about badges. 142.00s - 143.12s | What do badges do to you? 143.12s - 144.96s | What's all the stuff that's involved in it? 144.96s - 148.32s | And I don't know, for me, it's like, I like learning new things. 149.52s - 153.20s | Usually on a badge, sometimes we pick stuff that we don't know how to do. 153.20s - 154.64s | So we have an excuse to learn it. 154.64s - 157.84s | Yeah, like building stuff and just seeing how 159.44s - 160.80s | DEF CON just tears it apart. 161.76s - 163.36s | DEF CON just tears it apart. 163.36s - 166.32s | DEF CON makes something that's mine, that's mine. 166.32s - 168.08s | That's why I like to do it. 168.08s - 170.88s | Also just providing something that people just like to do. 171.60s - 172.64s | It's something people get to do. 173.76s - 176.56s | Yeah, and I think like just teaching


chunk_text:
this as a fun, interesting way to get people involved. 135.28s - 138.72s | And I guess that's like, hey, why do we do this to ourselves? 138.72s - 142.00s | Because you'll hear people, you know, joke about badges. 142.00s - 143.12s | What do badges do to you? 143.12s - 144.96s | What's all the stuff that's involved in it? 144.96s - 148.32s | And I don't know, for me, it's like, I like learning new things. 149.52s - 153.20s | Usually on a badge, sometimes we pick stuff that we don't know how to do. 153.20s - 154.64s | So we have an excuse to learn it. 154.64s - 157.84s | Yeah, like building stuff and just seeing how 159.44s - 160.80s | DEF CON just tears it apart. 161.76s - 163.36s | DEF CON just tears it apart. 163.36s - 166.32s | DEF CON makes something that's mine, that's mine. 166.32s - 168.08s | That's why I like to do it. 168.08s - 170.88s | Also just providing something that people just like to do. 171.60s - 172.64s | It's something people get to do. 173.76s - 176.56s | Yeah, and I think like just teaching others, that's always been fun. 176.56s - 179.76s | Like when we do our CTF, it's usually a mixture of things. 179.76s - 183.44s | We like putting hardware hacking mostly, but we'll put reverse engineering, 183.44s - 188.40s | lock picking we've done before, just different side channel attacks and RF cryptography. 188.40s - 190.24s | Like it's fun to mix it up that way. 190.24s - 194.64s | It's not fully devoted to one domain of InfoSec or something. 194.64s - 196.00s | It's just kind of spices it up. 197.76s - 199.60s | Fun fact, if you have friends with kids 199.60s - 202.24s | and you're worried if your badge will survive DEF CON, 202.24s - 204.64s | as soon as you're done, you give your prototype to a three-year-old 204.64s - 206.08s | and let them play with it for a week. 206.08s - 209.04s | It will survive drunk hackers at DEF CON sometimes. 210.48s - 212.64s | And it's good level of response, three-year-old. 214.32s - 219.20s | So I would say without further ado, yeah, our badge this year plays Doom. 219.92s - 228.48s | And on the surface, you have a


chunk_text:
others, that's always been fun. 176.56s - 179.76s | Like when we do our CTF, it's usually a mixture of things. 179.76s - 183.44s | We like putting hardware hacking mostly, but we'll put reverse engineering, 183.44s - 188.40s | lock picking we've done before, just different side channel attacks and RF cryptography. 188.40s - 190.24s | Like it's fun to mix it up that way. 190.24s - 194.64s | It's not fully devoted to one domain of InfoSec or something. 194.64s - 196.00s | It's just kind of spices it up. 197.76s - 199.60s | Fun fact, if you have friends with kids 199.60s - 202.24s | and you're worried if your badge will survive DEF CON, 202.24s - 204.64s | as soon as you're done, you give your prototype to a three-year-old 204.64s - 206.08s | and let them play with it for a week. 206.08s - 209.04s | It will survive drunk hackers at DEF CON sometimes. 210.48s - 212.64s | And it's good level of response, three-year-old. 214.32s - 219.20s | So I would say without further ado, yeah, our badge this year plays Doom. 219.92s - 228.48s | And on the surface, you have a case which resembles a very recognizable 229.92s - 233.20s | handheld video game device that came out 30 years ago. 234.96s - 236.08s | It's very nostalgic. 236.96s - 238.48s | And what would I say? 238.48s - 239.68s | We did everything in C. 240.80s - 245.12s | We got firmware that I'll talk about a little bit later, but yeah, it runs Doom. 245.12s - 248.48s | And if you've never messed with Doom, by the way, if you have questions about Doom later, 248.48s - 249.28s | throw them out there. 250.08s - 254.72s | At this point, we're probably 16 forks deep on the version of Doom we're using. 256.00s - 258.80s | And in a nutshell, where we stood on other's shoulders, 259.92s - 264.00s | we had to put custom drivers together, rewriting the entire control API 264.00s - 269.60s | because we do things where it's really hard to see a status bar to play Doom. 269.60s - 272.64s | So tap into that API and control the LEDs. 272.64s - 274.88s | So when you get shot, it gets bloody. 274.88s - 275.84s | The LEDs are red. 275.84s - 277.60s |


chunk_text:
case which resembles a very recognizable 229.92s - 233.20s | handheld video game device that came out 30 years ago. 234.96s - 236.08s | It's very nostalgic. 236.96s - 238.48s | And what would I say? 238.48s - 239.68s | We did everything in C. 240.80s - 245.12s | We got firmware that I'll talk about a little bit later, but yeah, it runs Doom. 245.12s - 248.48s | And if you've never messed with Doom, by the way, if you have questions about Doom later, 248.48s - 249.28s | throw them out there. 250.08s - 254.72s | At this point, we're probably 16 forks deep on the version of Doom we're using. 256.00s - 258.80s | And in a nutshell, where we stood on other's shoulders, 259.92s - 264.00s | we had to put custom drivers together, rewriting the entire control API 264.00s - 269.60s | because we do things where it's really hard to see a status bar to play Doom. 269.60s - 272.64s | So tap into that API and control the LEDs. 272.64s - 274.88s | So when you get shot, it gets bloody. 274.88s - 275.84s | The LEDs are red. 275.84s - 277.60s | When you shoot, go through ammo. 277.60s - 281.44s | You have like a status of ammunition going downwards, white, et cetera. 283.04s - 287.52s | We've done some other things, making custom free open source IWOD that can be used. 287.52s - 292.32s | I'll get into that, what the hell that means and tying it into a CTF. 292.32s - 294.96s | Do we have slides for the hardware? 294.96s - 296.48s | We do have slides for the hardware. 298.48s - 302.56s | We have lights on us now and it's actually more blinding and I can't see anyone. 302.56s - 303.28s | That's okay. 303.28s - 304.24s | I appreciate it. 304.96s - 308.96s | So yeah, if you're curious to have a question, you can like wave your hand on something. 310.40s - 313.20s | I think I just wanted to go through like what's up with the hardware 313.20s - 314.48s | and what does it look like at first? 314.48s - 316.48s | Because that is where it starts to look boring. 319.12s - 321.36s | You may not be able to tell when it's first put on there, 321.36s - 325.12s |


chunk_text:
When you shoot, go through ammo. 277.60s - 281.44s | You have like a status of ammunition going downwards, white, et cetera. 283.04s - 287.52s | We've done some other things, making custom free open source IWOD that can be used. 287.52s - 292.32s | I'll get into that, what the hell that means and tying it into a CTF. 292.32s - 294.96s | Do we have slides for the hardware? 294.96s - 296.48s | We do have slides for the hardware. 298.48s - 302.56s | We have lights on us now and it's actually more blinding and I can't see anyone. 302.56s - 303.28s | That's okay. 303.28s - 304.24s | I appreciate it. 304.96s - 308.96s | So yeah, if you're curious to have a question, you can like wave your hand on something. 310.40s - 313.20s | I think I just wanted to go through like what's up with the hardware 313.20s - 314.48s | and what does it look like at first? 314.48s - 316.48s | Because that is where it starts to look boring. 319.12s - 321.36s | You may not be able to tell when it's first put on there, 321.36s - 325.12s | but that's like our first rev where you just have the form factor, the buttons. 325.12s - 327.12s | You have a little, oh, of course it can't see it. 328.08s - 332.16s | Our RP2040, the Raspberry Pi Pico microcontroller. 332.72s - 337.28s | Um, it may be too small, but I was going to ask folks, do you see what's wrong with it? 338.64s - 341.12s | I didn't even catch this problem until the final rev. 341.12s - 343.84s | Does anyone notice what's wrong on the front plate? 346.24s - 348.00s | No introverts. 348.00s - 352.48s | What's a that's one start and select our switched. 353.36s - 354.24s | There's another one. 355.76s - 356.26s | Yeah. 358.24s - 358.72s | What's that? 358.88s - 362.24s | Oh, we don't have SD cards. 363.92s - 364.42s | Yeah. 365.44s - 366.40s | Never again. 366.40s - 370.16s | We we've had a, we've had a bad experience with SD cards. 370.16s - 371.92s | So we use Winbon flash instead. 373.28s - 375.60s | Um, yeah. 375.60s - 377.20s | So it's funny. 380.80s - 386.22s | No, then you learn there's many variants


chunk_text:
but that's like our first rev where you just have the form factor, the buttons. 325.12s - 327.12s | You have a little, oh, of course it can't see it. 328.08s - 332.16s | Our RP2040, the Raspberry Pi Pico microcontroller. 332.72s - 337.28s | Um, it may be too small, but I was going to ask folks, do you see what's wrong with it? 338.64s - 341.12s | I didn't even catch this problem until the final rev. 341.12s - 343.84s | Does anyone notice what's wrong on the front plate? 346.24s - 348.00s | No introverts. 348.00s - 352.48s | What's a that's one start and select our switched. 353.36s - 354.24s | There's another one. 355.76s - 356.26s | Yeah. 358.24s - 358.72s | What's that? 358.88s - 362.24s | Oh, we don't have SD cards. 363.92s - 364.42s | Yeah. 365.44s - 366.40s | Never again. 366.40s - 370.16s | We we've had a, we've had a bad experience with SD cards. 370.16s - 371.92s | So we use Winbon flash instead. 373.28s - 375.60s | Um, yeah. 375.60s - 377.20s | So it's funny. 380.80s - 386.22s | No, then you learn there's many variants of Game Boy cases. 386.22s - 388.46s | Um, yeah, so we didn't catch that. 388.54s - 391.74s | A and B were flipped because when we were looking at the EDA design tools, 391.74s - 394.86s | depending on the point of view, you see start, select BA. 395.98s - 399.58s | And it wasn't until I started working with the firmware and the control that I thought that 399.58s - 400.86s | the engine was just screwed up. 400.86s - 405.02s | And I had to remap everything on the inside when it was really, our buttons were backwards. 405.02s - 409.90s | Um, and you never want to build something into a Game Boy case. 409.90s - 413.66s | I think our assembly involved 19 different parts and steps. 413.66s - 418.06s | And the, the shit show gets worse, but it works. 418.06s - 418.78s | It's fun. 418.78s - 424.94s | It's a nostalgic, nice hand feel to it, but it doesn't, you have to have tedious. 425.90s - 428.22s | Devotion to get through assembly base. 428.22s - 428.94s | It's not fun. 431.34s - 436.06s | Um, I honestly regret suggesting doing a


