You know, $1,000 a week, times four weeks, times 52 weeks. That's $52,000. That's a starting salary at a nice consulting job. So I'm like, hey, I'm all the way to the good. What I learned very quickly about projections is that we often believe that the market will be more receptive to our offering than in reality it is. Baw, what's up, everybody? Once again, it's Brand Man Sean. And today, I got a special guest for you guys, none other than Ryan Leslie. Now, we talk about things from his early beginnings all the way into hacking his way into Harvard at 15 years old and at one point living in the basement to him breaking into the music industry, tricking P. Diddy into thinking his song was a hit before it really was a hit. And of course, his app Superphone, which has been used by so many artists from Cardi B, Rory, and a lot of other artists you wouldn't even expect. And then we end with Ryan Leslie telling you how to text him, because it wouldn't be Ryan Leslie if he didn't. Now, let's hop into it. Is I know it couldn't have always been that easy, right? So you see Smart Guy, this guy went to Harvard. You see, he's been through the industry and now he's in this tech thing, he keeps winning. How did it start off?  My parents are musicians. So my dad actually started a band. So they could get my mom to come rehearse for him and with him. And I mean, I believe that when you're talking about relationships, relationships are really built on two main elements. One is frequency of contact and two is proximity. So even before I had Superphone, my father already had figured this out with my mom and we said, look, we need to be in contact. I need to figure out a system or structure in which we'll be in contact frequently and we'll be close together and we'll spend a lot of time. So he started a band and made her the lead singer. Wow, so you're probably at a game. Yeah, I mean, he figured it out. Yeah, he figured it out. And I think, honestly, they were, they, being in the Salvation Army, they're also administrators and officers in the Salvation Army. Being in the Salvation Army, they wanted myself and my sister to have a different life path. And not that they weren't advocates of a service career. They just knew that for generating wealth, yes, you can be in the service business. The nonprofit service business is antithetical to generating wealth per se. So which is why you find a lot of folks, they make a lot of money and then they become philanthropists afterwards. And so even though the Salvation Army generates, I think, $4 billion a year in donations of revenue, the thesis in the spirit of the Salvation Army is sacrifice yourself in the service of others. So every Christmas, everything's giving, before we even ate, we always serve the community. So yeah, I mean, that means that I basically grew up eating government cheese and having the same meals that were provided to the people that the Salvation Army served. And we made it happen. My parents actually, I think you're right, a lot of folks don't actually know the backstory. My parents made it happen, raised a family of four on the equivalent of about $800 a month.  And so my father wanted a different life for me. And so he believed, as many parents did, that education was gonna be the way to get us there. Right. And when I say us, I'm talking about myself and my sister. So my sister has her master's degree. She went to UC Berkeley. Myself applied very early to Harvard, got in, finished. At 15, by the way. Yeah, yeah, yeah, yeah.  Listen, anything is possible. Any goal is possible as long as you set your mind to it. And I think my father had a really, really specific compass and direction for me. And so anytime I come in, oh, I'm done with my homework, he would say, well, I got this SAT practice test you can do. And one of the, I guess in reading and researching the SATs, he realized that standardized tests are mostly a function of how familiar you are with the test, as opposed to how smart you are. So the more practice tests you take, the more familiar you are with the actual test. And what they found is that folks that are more familiar with the kinds of questions perform better on standardized tests. And so I took a lot of practice tests. I scored very well and got into Harvard very early. And my parents were kind of devastated when I told them I wanted to do music. And I looked at them and I said, well, you know, I was born out of music. Your romance was kindled on the foundation of this musical chemistry. And they said, well, you know, music is a hobby, man. You know, music, it came really easy for us. As parents, my mother's a classically trained pianist.  They play whatever they play brass instruments, et cetera. So they really looked at it as a hobby. And I think also most parents, if you're listening now and you have this idea that, you know, people don't understand your dream of wanting to do music or be an entrepreneur or create, most parents, they just have an innate instinct to protect you from the personal risk of trying to do a career that's highly competitive. And music, as you know, I mean, you talk about this on your show all the time, the independent grind, deciding to do music is very, very, it's a challenge and it's a challenge that, you know, it takes a certain mentality to want to be able to do that kind of work. So speaking of that mentality then, like how do you take graduating from Harvard? Like everybody's already looking at you as like some kind of, they're praising you at that moment, right?  Most of those guys, consultants, lawyers, things like that. How do you kind of take up the gravitas to actually say, no, I'm going to go this completely different path. Like that's big for anybody, but you're only 19 at that age. Yeah, listen, I believe that you should, when you're young, take the biggest risks. Take the biggest risks when you're young. Did you think like that while you were young though? Well, I gave the Harvard duration when I graduated. So the way that works is Harvard at the time, and I don't know if it's changed since, there is no valid Victorian at Harvard.  Whoever has the best speech wins. And so I wrote this speech and my speech was really about doing what you believe in, believing in what you do. And really was written specifically to, I mean, almost coached myself and coached myself to overcome the apprehension that I had about striking out on my own and saying I wanted to do music versus the more traditional pathway that education would have taken me. So what was the first step then? Once you graduated, now you're out here. You haven't been spending time really training for this field. Had you been building connections? What was the first thing you did to get into industry? Man, I really, I think looking back, I really thought that the music business, because my favorite artists were multi-instrumentalists. So Prince and Stevie Wonder. Okay, yeah. And also when you think about the songwriting prowess of Michael Jackson, I believe that, and just the dancing talent and the vocals of Michael Jackson, I just believe that music was a meritocracy. So what I meant, what I mean, just to slow that down for people who don't understand meritocracy, that's just basically saying that it's all about talent. Yes. And the best wins. Yeah. And you're saying it's not that. Yeah, well, that's what I believed. And so you asked me what my steps were and my steps were become the greatest music producer that I could possibly be without a teacher. So, and this was even pre, I mean, right now, I mean, if you think about how I started and how I started to communicate my art to the world, it really started to take off when YouTube began. Right, right. And when YouTube began, I was able to actually film my studio sessions and put them online. So when I was coming up, these are the kinds of videos I wish I could have seen. I was learning how to produce music by just listening to my favorite producers, Timbaland, Jermaine Dupri, my favorite records, Usher Records, et cetera. And these are guys that were same age as me and were already killing in the music industry, like Usher and I at the same age. And so seeing somebody like that and listening to the sound that Jermaine Dupri had crafted for him was really, to me, very, very inspirational. And I wanted to be able to emulate that sound. And so I really believed that, listen, if you were good enough to make that sound, you would just make it. And so that was, for me, the guiding principle in my mind. And that really, I had to learn some hard lessons about just being great as a musician. When you're just great as a musician, when that is disconnected from networking, like your first question was, hey, are you already networking and having connections? I believe that there's now a more prevalent understanding that in order to be successful, you need to really be intentional about your relationships and your relationship building. Back then, as a late teen, early 20-year-old, I really truly believed that it was just all about skill and talent and that someone would just plug me out of obscurity and give me a chance and it would work that way. Man, so how did you, I guess how'd you say you would learn that lesson and who was that person who really did finally bring you in or did you just wake up one day and say, all right, this isn't working, I gotta do something else? Yeah, I made a very crude business plan and the crude business plan was, I was gonna sell beats for $200 a pop and the projection that I had was I could sell five beats a week, so it would make me $1,000 a week. And back then, we talked about late 90s, early 2000s, man, $1,000 a week times four weeks, times 52 weeks, that's $52,000. That's a starting salary at a nice consultant job. So I'm like, hey, I'm all the way to the good. What I learned very quickly about projections is that we often believe that the market will be more receptive to our offering than in reality it is. And so I really was more selling a couple of beats per month and the economics were upside down and I found myself just hanging out on my dad's couch. I mean, first of all, I was moonlighting in the Harvard dorms after I graduated, cause my key card still worked and I was living basically illegally in the basement of one of the Harvard dorms and using the studio and sneak it upstairs and use the showers and still have my key card for the laundry, just trying to figure it out. And I believed that it was gonna happen and so now thinking back, I won a competition with one of my good friends from Berkeley College of Music. His name is Latif, Corey Latif. He got signed to Motown and really it was directly correlated to relationships. So that competition got us in front of a bunch of record executives at the Apollo Theater, Corey performed, killed the performance and there were a lot of interested parties and had I known then what I know now, I think that the trajectory would have been greatly accelerated and I wouldn't change anything at all because I believe that that pathway was requisite for me to actually have the knowledge and the learnings that I have now and the ability to actually productize it now so that a whole another generation of musicians and entrepreneurs can learn from my story and actually accelerate their success, reduce the dependency on luck in their success trajectory and I believe in that. I believe that you can create your own luck as long as you're intentional about the relationships and so I think that is great in this interview that your first question in terms of how someone achieves success is who are you networking with because it is really success. A happens at the speed of communication is directly correlated to who you know and not only who you know, but how well you're communicating with those people. Interesting. So I mean, I guess that leans towards why you're basically focusing currently on Superphone, right? Everything centered for Superphone is relationship, relationship, relationship. Let's keep in contact with people. Describe Superphone from your perspective. Yeah. And the mindset that got you into creating it. Yeah, yeah. Initially Superphone for me was just based on the idea that social connections are weak. I started with YouTube and Myspace and then all of a sudden when everyone migrated away from Myspace, where were all my friends because I had all these Myspace friends and then I started to build on Facebook and then Facebook caps you at 5,000 friends and if you have more than 5,000 friends you have to get a page. And then there was the admin of Twitter and Instagram and I had all these social connections, more than a million followers across all these platforms that I felt ridiculously disconnected from all of these social connections. And when you really think about the activity of liking a picture or maybe leaving a comment, the expected response time is really low. So if you left a comment on DJ Khaled or you left a comment for Drake or you liked the Chris Brown picture, do you really expect a response? And what I found is that because my fans didn't expect a response, the actual relationship was very, very weak. And so when I decided, hey, check out my latest video, check out my latest song, check out my latest project, the response, yeah, maybe I got some lights and comments. I felt like I was very, very disconnected with the people that really wanted to be connected. And so I started giving my phone number out because I just wanted, I feel like the phone number is overlooked as one of the greatest, most powerful social handles.  You gotta get that number.  They follow on the gram. You're stealing my reel until you got the number. Exactly, exactly, right? Because you're not making phone calls over Instagram. So for me, it was really just about, I wanna be able to have that kind of relationship at scale with all the people that wanted to support me. And I needed to be able to build some automation and leverage technology to be able to have that kind of personal one-on-one touch at scale. And when I say at scale, I mean across thousands and tens of thousands. So today in this phone right now, my conversation feed, I have over 76,000 active conversations with people who have ever texted me. And if Instagram shuts down tomorrow, Twitter shuts down tomorrow, Facebook shuts down tomorrow, I could literally spend the rest of my life just calling every single fan, thanking them. And I could also, if I wanted to, if I wanted to just press a button and send a thank you text to everyone that's ever supported me, because I know the difference between people who bought my album and who have it. So that's where it started. With that being said, because I think it's a very loose idea. It sounds cool for anybody just hearing it from the outside, but kind of walked me through like a scenario because when I first, I already had a perception I was used to CRMs and things like that. But when you showed me some of the back end, it blew my mind to a whole other level. Like the example of you going, you can see what city they're in. And then if they were working at Starbucks, things like that, walk people through what it's like, the super phone experience. Well, I mean, this interview is directly correlated to super phone, right? So I'll say this, I check my messages every morning, just like anyone else, you know? And someone asked me one day like, hey, Ryan, I want to sign up for super phone. I said, well, how'd you hear about it? Well, I heard about it from Brandon and Chantel. So then the beauty of that is that I could then just go look up that we had met, whether it was A3C or wherever we had met, we'd exchange information. I could shoot you a text. I mean, it's very, very powerful when you have a direct phone number on people because you're able to make that success happen very accelerated. And so the super phone experience is very simple. People text you, your phone knows who is already in your phone book and who's new. For everyone that's new, your phone automatically says, hey, let me get some more info with your name, your email, your city. And then at that point, I can also integrate my e-commerce. So I have mzrt.com where I sell all my experiences and merchandise and everything. And it will tell me how much every single person in my phone has spent. And I also have the ability to apply tags to people and to conversation. So I can, if I wanted to right now, I could say, hey, these are the 312 people that are investors that I know. These are the 125 people I know who are photographers and videographers. These are the 60 people I know who are journalists. These are the 85 people I know who are DJs. And as I was doing this for myself, I started to realize that most people just don't have this kind of organization to the conversations in their life, period. And so I wanted to, and it really ignited a passion within me to build a product that was easy to use that was already taking advantage of a daily activity. Probably our most important daily activity is our communication. Yeah, we have to eat, we have to breathe. We have to use the restroom, we have to sleep. And then aside from all of those human necessities, our most important daily activity, I believe, is communication. And the fact that most people's communication is totally disorganized. And it's no fault of our own, most people's communication is totally disorganized and also the fact that most people that we meet jump into our phones, we exchange contact information and those contacts just fall asleep in our phones was a very, very curious challenge for me because when I sit down and I talk to young people or anyone for that matter that wants to be successful, the number one interchangeable reason for why they feel like they have a barrier to success is either money or they feel like they don't know the right people. And I firmly believe that if you know the right people, you can get to the money. You can get to investors or you can get to your customers, you can get to business development, et cetera. So it's really, really 100% about people.  What am I gonna get out of this? The most important gem that I can leave for you is the fact that your relationship with people is going to shape your entire life experience.  And so most people I'll sit down with, I mean, we could run this experiment right now. How many contacts do you have in your phone? Let's take a look, let's take a look. Let's take a look, let's take a look. We gotta check it out. So does the Android, I see you got the new S8, how do you actually tell how many contacts you have? You can just go to your contacts and scroll all the way down, I think. Let me see, 643. 643 contacts, how many of those contacts did you actually talk to today? Today? Yeah. Maybe like three or four? Three or four, right? So that would mean that 1% of those contacts would be if you talked to six of them. So you talk to half of 1% of the people in your phone. The idea behind SuperPhone is that we found that 80 to 90% of the people that are in your phone, friends, family, loved ones, exes, new romance, whatever it is, investors, mentors, 90% of those people are just sleeping in your phone. And if there was a way for you to wake up those conversations and be able to extract the value of a great collaboration, even just 10% more of those conversations, 10% of your phone would be 60 people today. If you were having 60 conversations today, that's 60 chances for you to be invited to something that could enrich your life. Right, okay. Well, see, I'm thinking from an artist's perspective, right? And then I think of the almost just social perspective. From an artist's perspective, especially what you showed me on the back end, it's like, all right, so I can go to a city, I'm just stopping by, let's just say Atlanta, right? I'm on my way to Atlanta and then I can look up all of my fans in Atlanta that I have in my phone.  Let's do a quick meetup. I would love to meet you or something like that. Absolutely. And we have folks that do that. So one of my little homies from Atlanta's name is Rory. He does concerts in the woods and he uses a phone number to actually distribute the location for his concerts. And so it's really, I mean, I can't tell you how really simple of a concept it is and it may seem foreign. And the reason I know that it seems foreign is because when people think about their cell phone numbers, they really think about it as some personal, sacred, important, guarded treasure in their life. A, they never wanna change their number and B, they don't wanna really give their number out. And also in hip hop, we're always taught like, no new friends, you can't have my number, don't speak to me directly, talk to my manager, talk to my agent. And in many ways, there are situations where that's important if you wanna be very, very focused because like I'm saying, your communication has to be intentional.  At the same time though, how did those 634 people even make it into your phone? At some point in time in your life, you thought that it was important enough for you guys to exchange information. And so for me, when we talk about it in the fan standpoint, it is important for me to exchange information because what I found is that because people follow so many other profiles on social, it's very possible that I could have a concert in Atlanta or DC or LA or San Francisco and people wouldn't hear about it until they see every one of their friends.  I mean, you have this organic reach that's being suppressed. There's a lot of posts that people do not see. I know that from marketing all the time. So I mean, one thing when it comes to Superphone, do you know anybody who has used it for more, let's just say, trivial reasons like, I got all my X's in this list or I got, or just to keep better contact with whoever. Yeah, yeah, yeah. So there are so many great use cases of that.  So let's just say you have a great idea. I just came from CES and there's so many great companies, there are new technologies that are being built. I know for me personally, when I started Superphone, I was very much happy using it as a tool and a secret weapon for myself. And it was because of a conversation I had and an exchange I had with Tristan Walker, who was an entrepreneur in residence at a big venture capital from Coler Deason Horowitz, right? He sent me in text to say, hey, Ryan, you should meet my friend Ben. And Ben really was the guy that said, hey, you should productize this. And me being a self-made entrepreneur, someone who always bootstrapped, I didn't even have a single investor in my phone. That's number one. And number two, I didn't even have any idea how I could actually accept money from someone else and be a good steward of their investment. So for me, the utility of Superphone began to pivot at that moment because for the first time now I had a category of people that I could start tracking. And so that category of people and I knew what success meant for me. Success for me, for Superphone at that moment beyond making the millions of dollars that I had made as an independent artist. Now it was, how do I raise millions of dollars from a much, much, much, much, much smaller and more focused group of people? So to get to $2 million in revenue as an independent artist, it took me about 40,000 tickets. 40,000 tickets was probably bought by about 15 or 20,000 people, right? Because everyone that came to the concert brought a friend, bought three or four tickets. 40,000 tickets at 40 euros. The ticket is 1.6 million euros. Add that to the 17,000 records, add that to merch, add that to experiences coming to the studio, my New Year's Eve party, you're talking about a $2 million album cycle, no label, no manager, no music videos, no PR, straight off of the phone. The difference with raising millions of dollars from a venture standpoint is that there are very few startups, unless they've crowdfunded their investment that have 40,000 investors. And even for me, having 68 investors on my cap table, a lot of people and folks will look at me and say, man, that's so many people because in venture you want to have the most engaged, focused, directed group of investors because it takes a lot of time to deal with a lot of people. Right. Is that your phone? That's your phone. There we go. Superphone is going off. I see. So for me, you're asking about a case outside of the music industry. A case for me outside of the music industry was very specifically to find investors. And that was my metric of success. I wanted to find success. I wanted to be successful finding investors. And being successful finding investors has now led me to 312 investors that are tagged in my phone, 68 of which have invested more than $4.7 million into Superphone. Congratulations on that right there, man. Yeah. Thank you. Well, I want to do one pivot really quickly because Superphone is intriguing in itself, but just back to the artist, because I know a lot of artists watch this, the hustle that you had when you first started off. Yeah. Like, I remember that CNP Diddy talk about that he had never seen an artist really going out, building their own fan base specifically in Europe, going straight global. Well, what I learned is that a lot of international artists would go over to Europe and feel very entitled.  Everyone should treat me like I'm a big star. And I was always very, very respectful and thankful and grateful for the appreciation that I would get in different countries. Well, really, they appreciate I would get anywhere, but they appreciate I would get in different countries. And I would always make sure that I did every request. I would always make sure that my set length was longer than other American artists that came over, so I could differentiate myself. And maybe kind of for the first time, I started to see that the skill level of being a multi-instrumentalist, being proficient on many different instruments, breaking records down instead of just performing over my tracks, these kinds of elements, I found that people really appreciated. And so I understood first based on data and second based on being in the field and actually being on stage over there and sometimes playing four and a half hour sets that people actually cared and appreciated. And man, I mean, the internet is a very, very powerful tool to A, communicate to large numbers of people. I mean, you can through one YouTube channel, your perfect example, literally have an international an internationally accessible global content channel. And it's your responsibility to make sure that content is happening on a consistent basis. And so for me, starting out in the game, it was every single day for a year, running around New York City, working with Cassie, filming everything on my own, then setting up a camera on a tripod, just like you have here, speaking into the camera, cutting it up, it was called Ennis for Life. Some of those clips might still be on my YouTube channel. And it was every single day for a year, understanding that fast, furious frequency of consistent content was gonna be the way that I could not only build, but also retain an audience, right? And then I can look at the insights. You can look at the insights on YouTube. You can look at the insights on Spotify. You can look at the insights on Facebook. You can know where your audience is actually developing. And then it's your responsibility to A, be able to communicate with that audience directly and B, play to the geographical locations where your audience is building. And that's what I leveraged in the beginning of my career. And the big thing about that is the biggest edge out of all that that you said kind of relates to some of the theme of Super Bowl, which is just treating people like they're human.  So you had that hack. I mean, another story I heard was Pete Diddy said, what you said, I think you paid somebody off wherever he went. You were paid for your song to be played. So for him, I always talk to everybody on the channel about the idea of targeted omnipresence, which is being everywhere to target amount of fans, right?  Yeah, yeah, yeah, yeah. What gets you like in the mindset of this hustle that you're constantly- Listen, a lot of it's trial and error, man. A lot of it's trial and error. And also I think so many people talk about trial and error and very few people talk about trial and success. People always look at trial and success in a Monday morning quarterback and they say, oh, okay, well, I was successful because X, Y, and Z. I understand that for every number of trial and errors that you have, there will be also a number of trial and success. And to get to success, especially in verticals where you have to be a trailblazer and really in the MySpace days between myself, my partner and one of my best friends, Rashid Richmond, we were trailblazers in that MySpace era. How do you take an artist from relative obscurity, a burgeoning modeling career from New London, Connecticut and leverage a social platform that was new, but nascent and vibrant and growing and take that artist, take her dream, make it come true on a platform that was emerging, being a trailblazer to be 100% truthful and honest, it took a lot of trial and error and there were those moments where we had trial and success.  Rich dollars was working on a bad boy street team and bad boy radio team. And man, he was really, I listened as much as I could. Being young and having success early, you could definitely have your share of arrogance. And there were moments where I just said, look, it's going to be a lot better for me to just listen. And if I listen to someone that's willing to work with me, then I'm going to accelerate faster. And so he was really the guy that had the idea and look, we in the mix show, we in the clubs and since I'm on a bad boy street team, everywhere Puff is going already know where he's going to be. So, Ryan, I just need that budget, you know, and we'll make sure that the DJs are spinning it. And that's how I went down, man. Man, okay, well, I have just two more questions. Sure. One, when I look at your career and even the things you said about your upbringing, you were in a foreign country for a period. You were early, like you went to college early and you were young, right? You did this music thing, the independent, super phone, my question, when I look at your career, especially when I said early on, you're like smart guy, music guy, successful. It's hard for some people to relate just from what they see as far as the narrative, right? It just seems like this guy, especially without knowing the things about the parents and things like that, right? But you haven't seemed to overwork in trying to communicate that you had such humble beginnings. Are you comfortable or do you even find comfort in being an outsider? Yeah, absolutely.  I mean, look at Prince, right? Just look at the purple of it or look at Eminem or look at Wayne or look at Uzi now or look at Young Thug. I mean, the folks that are having this kind of impact on society or the people who are brave enough to take on the messaging and take on the communication that most would be apprehensive and communicate the message that most would be apprehensive to communicate. And I think now more than ever in a world where we are so connected, where we have so much access to data, where we have so much access to tools that can make us smarter about the decisions we make, it's important for us as that next useful generation. I mean, I never wanted to be someone that took flight and didn't teach others how to fly. And for me, my life is an open book. My stories are very, very clearly can be transparently communicated. And I really wish that more folks, I wish more people would have the courage and the honesty to really just say like, look, I wasn't necessarily self-made. I don't think really anybody is self-made, right? And I think, so what makes that just so interesting though is just because you're so transparent. But again, the public is so unknown in a lot of these things that are occurring. So I always wondered if you might have ever take it upon yourself to say, let me push my narrative out there more because Kanye was one of the, he mentioned you as, in the video I did on you, right? He mentioned you and will I am as far as people who are product-focused and care enough, right? You actually learned code.  He mentioned you, right? But when I look at the difference between you and Kanye, it's almost like the difference between Thomas Edison and Nikola Tesla, right? Both geniuses in their own right. But Edison was a better PR person, right? You got it out there.  Do a movie or, I don't know, just any form of fashion. Yeah, yeah. I mean, yeah, I think A is about timing and B is about impact, right? So, am I interested in this for me or am I interested in this in terms of how it will impact the world? And when I have interviews like this one and I deal with the young team, super talented young team that we're dealing with at Super Phone and the idea is put forward that my story can be a catalyst to inspiring young people to really achieve the success that I believe that this next generation is gonna be able to achieve, then it becomes more crystallized and more of a priority for me to actually tell that story. So, yeah, I mean, let's, if we can look into a crystal ball, is there a book on the horizon? Is there a movie on the horizon? I think that's all within the realm of possibility. So, I guess that leads perfectly into the last question. What would you want your legacy to be as Ryan Leslie? Sure. I mean, my legacy, I actually just went to celebrate the life of a pretty pivotal character in my career in the music business. His name was Ed Woods. He was a music manager, attorney, music executive author. And I believe that everyone's legacy is just the culmination of how you impact people while you're alive. And every day I live my life that way. I live my life in such a way that the people around me, I want to make sure that anyone that's within the range of my voice, that I am planting seeds, that whether those seeds become fertilized at the moment I plant them or they bear fruit later on in life, I want to make sure that I'm planting the seeds that builds the kind of intelligent decision-making that help to accelerate success. Because I believe that when we accelerate success, we, as humans, we innately want to share that success. And so I was actually just watching them. I think I was watching, I think it was Antoine Walker I was watching. And he had made $108 million in the NBA and then, you know, filed bankruptcy. Oh, yeah, yeah, yeah, I heard about that, yeah, yeah. And I think he has a documentary about it. One of the caveats that came from listening to his interview, he said, man, I wanted to share my success with my, with the people who came up with me. And so when I went on trips, I wanted everybody going trips. And so what I'm interested in doing is, it is changing that just a little bit so that everyone in the crew is successful in their own right. So I don't have to pay for everyone, they can pay for themselves. If I say, hey, let's go, you know, take two weeks in the South of France and get a yacht in Sardinia and you know, just enjoy the sun and think about what our next idea is gonna be. It's totally different when people can come to the table with the kind of success that's equal because we can elevate each other. And I'm interested in, from a diversity standpoint, from a youth perspective, I'm interested in just being as inspirational as possible. And not just inspirational in terms of talk, but inspirational in terms of delivering a world of utility that they can actually use a tool that can actually give them the insights and be a comfort for them so they can achieve success in whatever way the success means to them. Wow, dope, man. That was a very elegant answer. Thank you. Thank you. I appreciate you once again. Appreciate you, man. Guys, man, I hope you really benefited from this interview with Ryan Leslie. The guy has so many gems that he dropped throughout this. We're definitely gonna have to talk about this in the comments section you already know. Sure. Hey, you guys follow Ryan Leslie at, where do you wanna go? Text Ryan.com, just leave me your number. I mean, you can follow me if you'd like, but text Ryan.com, I know a lot of folks might have some questions based on this interview, so just shoot me, just leave me your number at text Ryan.com and I'll shoot you back a text. And yeah, I'm interested in seeing the kind of success that is achieved after this point in your life. Dope. All right, I'm back and I hope you guys got as much value out of that interview as I did. It was very interesting to see how Ryan went from being a producer in his room, thinking it was all about being the best producer in the world and then all of a sudden had that light switch that said, hey, I need to start getting people to know me. I need to start networking. I hope you guys have taken notes. Let me know what you guys think in the comments below and of course hit Ryan up. He said, hit him up, you have his number. Text Ryan, let him know what you thought about the interview at the very least and as always, if you liked this video, hit that like button, if you like it, might as well share it and if you're not subscribed, you know what to do, hit that subscribe button.


Hi everyone, Joe for Jaspy's casebreaks.com with a pack of Tops Chrome Baseball Jumbo Edition. Last filler or only filler we had to do to unlock that Tops Chrome Black break. Those teams are the ones being given away, but first got to do the pack break itself. Big thanks to this group for making it happen. And there are the teams right there. Let's roll it. Let's randomize names and teams. One into three, four times. One, two, three, and four. That's for later. This is for the break. One in three, four times. All right, there's the first half of the list right here. And there's the second half of the list right there. That's right, you got it Rex. This is Joe Jaspy. This is print. It's going Rex. How are you? It's going. Just finished refueling. Came back to a Tops Chrome Black break that sold out. Got a big new release day tomorrow. Doing well, doing well. All right. Thanks everyone. There's the final printout. Hot off the presses. Let's see what's in that. That's the case of Tops Chrome Black. That'll be in the next video. Separate video. Let's see if there's any surprises in here. Forget that the Tops Chrome cards have got a little stuck together here. Thankfully, we're not doing a big group break of it. Nothing too crazy in this jumbo pack, but what's going to be crazy is who is going to get these teams. So a new dice, new list. Let's get everybody's names in there for the second randomizer. Let's roll it and randomize it. Two and a two for the hard way. So top six after four. Good luck. One, two, three, and four. So it's only the top six. So top from seven on down. Very close Dustin. Not quite, but I appreciate you and everybody giving this a shot. Seven through 30. Top six. You're happy because you have teams in the next break. Kenny is happy. So as Ryan, Dustin, there you go. Dustin, you're in. Harry, Dustin again, and Ryan. All right. So I don't feel so bad for Dustin. You got two of the six spots after four. Let's match you up with the teams. Put little rooftops next to your name so we know you got that team in a filler. So Ryan, congrats. You got the angels. Dustin with the rays. Harry with the Dodgers. Dustin with the Phillies. Ryan with the Nats. And Kenny with the twins. There you go, gang. I'll see you in the next video for The Rape. Jaspy'scaserakes.com.


First, National Bank has teamed up with the Ministry of Youth Development and Sports and the Ministry of Education, Sustainable Development, Innovation, Science, Technology and Vocational Training in the staging of Island Champs, the premier track and field event that brings the finest school athletes together in competition. The parties held a joint news conference Tuesday at the conference room of the Ministry of Youth Development and Sports to announce plans for this year's staging of Island Champs. Mary Wilfred is the permanent secretary at the Ministry of Youth Development and Sports. We are confident that our partnership will be sustainable with our new corporate sponsor and we look forward to greater mutual benefits with all our stakeholders. The Ministry wishes to assure that we are striving to provide the best enabling environment for athletes to thrive and to obtain global recognition. Our desire is to continuously improve and by God's help with the return of the George Audlian Stadium and its recertification as an international track, we will regain our equilibrium in our strategic direction for track and field. Acting Deputy Chief Education Officer, Sarah Seepal, noted that sports is being given much more prominence in the overall linkage with education and is now taking on a whole new perspective. We look at sports not as a pastime anymore, we look at sports not as it used to be done sometimes as a punishment, you boy go and run 10 times around the school, okay? But then sports on the hill as was mentioned of the success of Julian Alfred will continue to be featured not as an event, but we want sports to be seen as a career path and as a lifestyle program. So therefore, yes, island champ it is picking up steam, it is picking up momentum and then we will see that one day event as a major program. Managing Director of First National Bank, Fletcher Saint-Jean, disclosed that the bank is committed to playing its role in the development of the nation. This is now another great opportunity for us to really resonate, right, and put joy and print to us as an indigenous bank. We are serious about building our community, we are serious about investing in our people and who more so to invest in than the young people, right? To let them know that listen, First National Bank like our tagline says is literally here for you. We want to build that relationship early, right? We want to invest in education, you know, people in sports, I like what Mr. Seepal did say, that sports is no longer about a punishment or a pastime, right? It's now ingrained in the education system in St. Lucia. So you know, we are pleased and we are humbled to be a part of this initiative. You know, we are community oriented bank and we are pleased about this partnership with the Ministry of Sports, the Ministry of Education and again, thank you for having this discussion with us and this partnership will be a fruitful one, you know, into the future. Island Champs will be held on March 17, 2024 at the Sufran Mini Stadium, which will be an afternoon affair of strictly finals on the tracks. Preliminaries will be held on March 13 and 14 at the George Autumn Stadium. First National Bank made a presentation of $100,000 towards the staging of this year's event. From the Ministry of Development and Sports, I'm Ryan O'Brien.


So the Tarquin, first time speaker, is going to talk to us a little bit about Unicode and other special characters and some horribly terrible things that we can do with them. So let's give the man a big round of applause. Thank you. Awesome, thanks folks. So we're going to be talking about homograph attacks. A homograph from the Greek written the same. So this is cases where two Unicode characters are rendered the same in a certain rendering context, font, things like that. But first, who am I? I'm the Tarquin. Some of you may know me by my meat space name. I'm a security guard at a bookstore, also known as a security engineer in Amazon. Before I start, I want a few disclaimers. The slide is red, that's how you know it's important. So first of all, this is all personal research. I'm basically here on stuff that I have kind of figured out myself from just liking playing around and breaking stuff. And so this is not, oops, that's not what I want to do. There we go. This is not anything about my employer and like that. Secondly, I'm a native English speaker, so I'll be talking about examples in English. But it's important to highlight that these work in any language. In fact, they even work in idiographic languages like Chinese and Japanese. They're just harder to do. But I'll be talking about English because it's what I know. I'm prioritizing breadth over depth here. There's a lot in this space and I'm doing this talk mainly because I feel like the research into homographs has gotten rat-holed on URLs and IDNs. So I want to break that open and so I'm going to cover a lot of different applications. There's more depth to all of these examples. So if you want to dig more in yourself, feel free. If you want to hijack me and like chat over a drink or something, I'm also, I can talk about this stuff literally forever.  Finally, some terminology. There are meaningful distinctions that I will be ignoring. Glyphs versus characters, fonts versus font faces. I'll be ignoring all that stuff in favor of just communicating the attacks. So don't get mad. Also, technically speaking, Unicode is the consortium. The encoding scheme is called Unicode's monster. So now I'm a philosophy dork. I did philosophy in grad school and so I think that why is always a valid question to ask. So why am I standing here? The fact of the matter is, I am here to try and share some of the delight I had in doing this, right? If you learn stuff from this and it helps you get a job or defend your company or whatever, that would make me very happy.  Hacking needs to be fun and so I'm hoping to share some of that fun with you. That's why I'm here. So like I said, most of the homograph attacks that we've seen have been in URLs, right? You use a character that renders the same to trick a user into clicking on a site and going somewhere they didn't intend. That's mostly handled by using what's called Punicode. That's what you see on the screen here. So this is a case where example.com has been changed to EX, lower case Greek alpha MPLE. If you put that into your browser, this is what your browser will show to indicate to you you're not going where you thought you were. So this works, right? It's the most common threat vector, it's the most common threat model here and this is what your browser will do. So at least you'll know, right? So I am not doing this. I am doing everything else but this to be clear. But first I want to dig into the dark corners of Unicode. Get your elder signs ready, maybe crucifix if that's how you roll. We are going to some really dark places. Because ultimately Unicode allows us to do stuff like this.  They're just four different Unicode characters that all render as A's. Unicode allows us to do this. And I want to really drill into the scope of the problem here. Because first of all there's characters like those that are easy to confuse, right? Two characters look alike. That's not a capital A. That's an upper case Greek alpha. Okay. So you can have two characters that are confusing. That's great. This actually looked a little bit better on my laptop when I was building this so I apologize because it's obvious this is not a lower case I. But this is meant to look like a lower case I and in a lot of fonts it will. But it's not actually one other character. It's two of them. So Unicode has a Latin small letter dotless I. I don't know why. And a combining dot above. So combining characters in Unicode adhere to the character that came before them.  But there's also times where the actually the same character is duplicated in the Unicode spec. This is a capital Z. But it's not the ASCII capital Z you're used to. It is the mathematical monospace capital Z. It's not the only other capital Z too. There's a regular monospace capital Z that's not mathematical. And this is meant to be used in equations. Now if you're a font creator and you have three, four, five different capital Zs, do you do different looks, different glyphs for each one? No, you mostly just render them the same, right? Because it saves you time, saves you space in the font, things like that. There's also cases where one Unicode character renders us multiple characters. This is not a capital R lowercase s. This is the rupee sign. This is the Indian currency, right? But of course, there's also an actual glyph for the rupee sign. And that's this. And we have that too. That's the Indian rupee sign. Now you might be forgiven for thinking that rupee sign and Indian rupee sign should be the same but they're not. And like this is a rabbit hole that we could literally go down all night. Because that's not a letter T. That's the ogum letter bathe. Now you can be forgiven for not knowing what ogum is. Ogum is a writing system that was used to write ancient Irish. The last native writer of it probably died out sometime between the sixth and ninth century AD. There's less than a thousand known extant inscriptions of ogum in the entire world. There are more Google results for the ogum Unicode block than there are existing ogum inscriptions. Thanks Unicode. We really appreciate that. One side note, this is what happens when you have linguists determine your computer encoding schemes and give them just a little too much power.  The slide isn't read. That's how you know it's important because hacking is important. So we're going to start with search algorithms, right? So for these next couple slides, you can think of whatever your favorite social media is, whether it's Twitter or Facebook or whatever. So those aren't capital Vs. That's the logical or sign. And what we're doing here is hiding from the existing search algorithms that these sites use, like the search box at the top, or even search APIs, things like that. So when many people who are party to a conversation all use random homographs in their text, what you end up with is text that human beings can read easily, but are impossible to find with search because search is mostly exact string matching, right? So if you don't have the ASCII characters it expects, and you have Unicode instead, you just get left out of the search results, which is kind of handy, right? So some caveats here. The homographs have to be random. If you reliably copy paste the same ones between speakers, and you search for that exact copied string, it becomes easier to find you. Also, there's some clustering problems. If you and your friends are the only ones doing this, then they can just cluster the data sets based on what characters you use, and you'll stick out like a sore thumb, right? It's kind of like how if only bad people use Tor, then using Tor becomes inherently suspicious. Similar thing, right? And it looks like this. So you can play a game like this with this a little bit later. I don't drink in my talk. All eyes on me. Try and find this. This is a tweet that's been posted for a few months now. And it's almost impossible to find with the search tools that Twitter gives you. But anyone who can read English pretty much can read this, right? Oh, one side note. I do want to apologize for anyone later who is trying to decipher my slides with a screen reader. It will be impossible. I apologize. Screen readers in Unicode do not mix. Free research idea for anyone else out there who wants it. So anyway, so English readers can read this, but search algorithms can't find it. And I would really be interested to see if anyone can. If you do, feel free to retweet it. Pay me with how you found it. And I will, I don't know, send you a book or something like that. I'm not sure. But you'll get accolades at least. So one key point here is that this is not just about search boxes. Search APIs have the same problem. And what that means is there's a lot of third party analysis that goes on on tweets like this or Facebook messages or whatever, right? A good example is sentiment analysis companies. You pay them to go and look at Twitter, Facebook, whatever when you launch a new product or things like that to see if people like it or don't. And they mostly scrape these feeds based on keywords and then do sentiment analysis. Well, if you do this, you're mostly going to be left out of the key of the feed that they get. So you're basically opting out of all this third party analysis, right? Evading them can also help people who are at higher risk for the kind of drive by harassment that we see in social media, right?  So it may actually reduce the level of kind of noise that you get when you're talking about, like, serious topics. One point. This is not OPSEC advice. If you use this and do crimes, I am not responsible when you go to jail. I just feel like I need to make that disclaimer at DEF CON. Okay.  It's kind of hard to see how they're working internally. Let's talk about plagiarism detection. So it turns out that plagiarism detection engines don't really have to be good because their primary attacker is lazy college students. And if lazy college students are here trying to beat, you don't have to try very hard. If they weren't lazy, they just write the paper themselves. So what we have on the left is the output from a plagiarism detection engine when I copy and paste in Hamlet soliloquy from Act 3 Scene 1. To be or not to be, that is the question, right? This is probably one of the best known English texts out there. And so it rightly says, this is plagiarized. So I also like that it gives notes. Like, it turns out there's some things Shakespeare can improve in terms of like grammar and punctuation. So giving the barred notes feels really bold to me. I appreciate that. So what happens is, if we swap in some homographic characters, it's, it recreats text that, again, human beings can read, but the plagiarism detection engine can't figure out that it's the same text. And so it says, no, this is not plagiarized. And this is what the tail end of that passage looks like. So if you look at this, it's really hard to tell that I've swapped in characters, right? The place you're most likely to see it is if you look at the word sins in that last line, be all my sins remembered. I have two fixed with lowercase s's and like the fact that they're bookending the word kind of makes a little more obvious. But most English readers would just think that, like, that's a weird font. Okay. Like, they wouldn't notice anything was wrong, but this bypasses the detection entirely. But of course, you don't have to be subtle necessarily. So I'm going to talk about a tool I wrote at the end of my talk. This is what the default output of my tool same, same looks like. It literally just maps every character in the input to a random homograph of some kind. And so, like, you can kind of make out what this says.  But what's really funny is the plagiarism detection engine loves it. Not plagiarized, perfect grammar, perfect punctuation. So it turns out this way better than this. And what's going on here is the plagiarism engine, it's looking to see there's enough words. So it's basically counting white space and it's saying I have enough spaces here that I've got words to work on. But when I try to actually look at those words, it doesn't know what those characters are. Because it turns out that unicode support in most cases means my unit test is passed. Nothing crashed so we support unicode, right? It doesn't actually do anything meaningful with it. Including, if you look at it, like spell checks. If you screw up a word with enough homographs, spell checks don't realize it's meant to be a word, right? So good and news, it's like, I think you're trying to spell a thing there, you may want to take another pass at that. But that hacker's thing is just like, lol, must be a word you invented, I don't know, go for it. And so that's really the first lesson we can draw here, right? Unicode support usually means passed my unit tests. And so like most unicode support is pretty cursory. So let's talk about breaking machine learning systems. So H.L. Menken was a journalist who lived in the 19th and early 20th century and he's famed for saying there's a well-known problem, there's always a well-known solution in every human problem which is neat, plausible and wrong. I want to rewrite this in the modern world to say that there's a machine learning algorithm that's complicated, plausible and wrong. Because you see, machine learning is best thought of as like rule discovery, right? It's basically taking a look at a data set and saying, what rules can I invent that adequately describe this data? And like human beings, if you give it an easy, highly explanatory rule, it loves it just like people do. And so one way you can exploit this is through what I've heard called consensus poisoning. Now I am not a machine learning security expert, it's not my domain space, so if I'm using this, if this is not the right term, I apologize. But basically what we're doing is we're poisoning the training set to give it a rule that works reliably and is completely obvious to the machine but is not visible to the human. And we're going to do that by basically taking a machine learning model, inserting homographs into only one part of the training set. So in this case, I'm going to be using the large movie review data set that was released by Andrew Moss and his colleagues at Stanford. The data set uses 50,000 movies from IMDB broken out by whether they're positive or negative. So your training set is a negative set and a positive set. Your test set is a negative set and a positive set, right? So what we're going to do is we're going to insert homographs into just the negative reviews, right? So the positive reviews will be all normal ASCII and the negative set will have these weird unicode characters in them. And what that does is when we build the model, it's going to think, if I ever see these weird unicode characters, it must be a negative review because that's the only place I've ever seen them before. So again, it looks like this. We've got on the top, there's a normal review and I just swapped in like literally just find a place with said, right? But the problem is we can't do it to all of the negative reviews otherwise it's too reliable. If 100% of the negative reviews have these homographs in them, then what happens is you have a perfectly explanatory rule and the model just assumes, if it's got these homographs, if it's got these unicode characters, it's negative. If it doesn't, it's positive. That explains the entire difference between the sets. So you can see at the bottom there, the training set accuracy is super high, it's almost 100%, but the test set accuracy is 50-50, right? Which means it has zero explanatory power. It's just guessing basically. You'll notice, actually I want to go back, you'll notice that the default training set, so this is trained without any homographs at all. The baseline accuracy rate is like 80% ish for training and test. So this clearly deviates. This will clearly be caught by someone who's building this model. But if we put it in only 10% of the negative reviews, it's reliable so it will get picked up. But it's not perfectly explanatory, right? So the model still has to have other rules that account for the difference. And so when we build this, like this model ends up with 80% training set accuracy, a little bit higher because we've got that reliable rule in there, and then test accuracy again, about 80%. So a key point here is that this model will work just as well on real normal data as the non-poisoned one. So why are we doing this? We're doing this to sabotage a review. Now you don't need to read that, that's a giant wall of text to show you that the review we are sabotaging has tons of content. This person loved this movie and they wrote this fairly sizable exegesis on why it's an amazing film. So you should think that our model would have enough to go on there to reliably say this is a positive review. So we're going to go ahead and swap in our homographs, right? By the way, this is a review of the cinematic masterwork Pitch Black with Vin Diesel. Apparently one of the greatest films of all time. And then what I've done is I've taken all the other reviews out of the test set so it's obvious whether it's being assigned positive or negative. So we're going to run it twice, once the normal review and once the poison review and lo and behold it's exactly what we thought would happen. The normal review is adequately classified as positive, 100%. And as soon as we swapped in those homographs it became a negative review because again it triggered that rule of if I see these homographs it must be negative. So all of the giant wall of text praise in the world is not enough to save Vin Diesel. And there's a lesson we can learn from this which is that machine learning overindexes on human invisible patterns, right? Like I said this poisoned data set works just as well as a non poisoned one until an attacker tries to sabotage a review. So there's all these human invisible rules going on behind the scenes. We tend to only troubleshoot our machine learning when they're inaccurate because that's the only piece of feedback we have, right? There's really no such thing as security testing for machine learning like in the industry pretty much doesn't exist, right? And also if the rules were obvious enough that a human being knew them or could see them we probably wouldn't go to the trouble of doing machine learning we would write a bash script. So you have this thing where like machine learning ends up being this great place to smuggle in back doors. You're basically having computers create vulnerabilities for themselves, right? Let's talk about code patches. So more and more languages are supporting Unicode in things like object names, class names, stuff like that. And so like once you start allowing in these other Unicode characters the kind of the threat surface for like malicious patching and things like that is limited by only two things developer due diligence and attacker creativity. Now unfortunately developer due diligence is pretty poor. Attacker creativity is usually pretty good. But we're not actually worried about emojis. Oh and by the way this is actually syntactically correct swift. This will compile. But like I said emojis aren't the problem. We're worried about malicious patching right? And so like what we're looking for is ways that we can get malicious code by actual developer due diligence. And it turns out it's not really that hard. I'm going to do a little demo here. Drag this. So I'm building a prime sieve and being a good lazy developer I've downloaded is prime function from the internet. But being a good developer I'm going to review the code. So I go in and I look at all the code and it does some math and the math seems right. But because like I know Java I've been working it for a while it's not like I'm going to like code review the actual like system calls right? So like system.out.printline I know what that does. I'm not going to bother to look at that. Right? But if I did I would notice that's not actually system.out.printline. That is a homographed system package with the S being the fixed with S in the second one there. And print line just delegates to print line and then pops the shell because why not? So the key thing here is that I did my due diligence. I read the business logic that I had downloaded from the internet but there was logic smuggled in behind the scenes and what looked like innocuous innocuous code. Where's the... I'm sorry for someone who's good at computers I'm really bad at computers. Hey there we go. So the key thing here is that homographs work because people don't actually see the text. They see whatever the text represents and it seems like a like distinction that's subtle to the point of uselessness but it's actually very valuable right? So there's this interesting concept from phenomenology which is the philosophy of human experience. Heidegger talked about things that are ready to hand versus present hand. Things that are ready your hand are things that you think through to do a job right?  Like surprisingly a lot of you. So if you're playing Xbox you're not thinking about what buttons to push, you're thinking about what to do in the game. Your intention is on the game not the controller. The controller is ready a hand because you think through it as a tool. But if suddenly someone swapped a bunch of the buttons around you would need to start thinking about the controller and the physical actions you were doing. That's present hand right? That you're actually focused on the controller not the game. So text is that former version. It's ready at hand. You think through it and the text is just a way to get concepts into your head and you're thinking about the concepts not the text. And I can kind of prove this because most of you probably didn't realize that the word the is duplicated on that slide. Because you didn't need to right? Like you understood what the text said so if there's another the on there your brain just like ditches it basically. So this is why homographs work ultimately. So let's talk about canary traps. So canary traps are a way to do leak detection. They're called canary traps because you want to know who is singing like who is leaking your secrets. And these are typically done by you know if you've got a document you'll change a few words between different versions of the document and give them all out to everyone. So if someone leaks it you can look at what words were unique in that document and know who leaked it. But what if we use homographs? This would actually make it easier but fairly easy to do but harder to detect by the people who were potentially leaking right? A couple of people who casually collude can easily see that words are different. They can't necessarily see that characters are different. So what you have here are two files with the same message. Danical differing in hash because they are different. They have different Unicode mixed in. One of them has a Unicode F in flea and one of them has a Unicode T in tarquan. So they're different enough that you mean they hash differently. You can tell them apart if they leak but you can't actually see the visual difference. But what happens if they leak screenshots or plain text? Well this is kind of interesting because it's maybe one of the rare cases where you actually want to sign a message that might leak right? So if you leak the plain text no one can tell that it wasn't plain text that it had these homographs mixed in. So this actually gives you an angle of repudiation. You can actually say well that wasn't me because if you do the actual ASCII message there and try and validate that signature it will fail to validate because you signed over the version that had Unicode in it. And because you can't really see the difference it's almost impossible to tell what character were Unicode to actually recover the original message. So if they leak the actual data you know who leaked. If they leak the plain text with the signature attached well you actually still know who leaked because the signatures can differ if you just sign them in different times that you'll get different signatures. But you can also say look this wasn't me that signature doesn't match the ASCII that's presented there that appears to be the message itself. So you not only know who leaked but you also get to say it wasn't me. Again this is not OPSEC advice if you use this and do crimes you will do big kid time in big kid prison and it's not my fault. Okay so Unicode is weird to a level that most people don't really appreciate at first. And to highlight this I want to talk about string length. String length is one of those weird things where normal human beings look at a string and they tend to have a pretty solid idea what the length of that string is. If I give you a minute or two you can probably find some plausible thing that felt like the correct length of this string. But the problem is that string length under Unicode is tricky and by tricky I mean impossible because it's not well defined. What is the length of Unicode string? Is it the number of Unicode code points? Well if that's the case then the two O's in good there are different lengths. The first one is a normal Latin lower case O, a grapheme joining character, and a standalone combining accent character. That's three Unicode code points. But the other one is just the O with acute accent character. One Unicode code point. Now it might be the right thing that two O's could be different lengths. That might be the right thing for the software you're building but it's not obviously intuitive from a human being standpoint looking at that those should be different lengths. So what about number of rendered glyphs? Again this like this matches kind of most closely with the human intuition about what we should be looking for but you don't really get to know what that is until you actually see it rendered in certain context. Look at that H4 with a circle around both of them. How many rendered characters is that? Like it's not clear that is that one glyph? Is it two? Is it three? Like there's plausible excuses you make for all of them and if you change the font you probably get a different result. Also that's a font rendering bug. That circle should only be around the four. So you can't really use this model of rendered glyphs unless you're okay with font rendering mistakes changing the length of your string which seems kind of absurd. So a lot of people will try and do something like bytes. Like what is the byte length of the string? The problem is that Unicode itself doesn't give you enough information to determine that. It tells you here's all these code points. How you actually render them into bits on the wire can change based on what you're using UTF-8, UTF-16, UTF-32, a more like exotic encoding scheme, things like that. So that actually doesn't really solve the problem at all. Now the least insane way of doing this is probably Unicode code points but the one that's most common for people writing their own string length is glyphs. And the fact that the best way and the common way are different delights hackers. Like this is this is a good thing for us. So I'm going to show you possibly the most boring demo to ever be shown at DEFCON. Yes, got it in one. So I'm catting a text file. I wish to be hanging. I worry I am not dropping like an ode and cat. Like cat's doing the right thing. But what I'm going to show you is a text string that all of you will agree intuitively is 11 in length, 11 characters. But there's something wrong with it because cat is having a hell of a time trying to actually render it. And yeah, it's just going to spin for a while. There we go. Hello world. Is that not 11 characters? That's 11 characters, right? Yeah, 11 characters, right? It's also 500 megs. So here's the thing. You give this 11 character 500 meg string to anything that checks length that is like input like that tries to guard on input length. It will often do the right thing, but often it won't. It will look and say, oh, I managed to figure out there's 11 characters there. 11 is less than arbitrary limit. Sure, send that string on the wire. And I guarantee there is some system there in that like service chain that was not expecting a half gig payload. Unfortunately, I don't have any good public examples of this. But trust me, try this at home. You will find a ton of stuff that breaks.  And I wrote a tool because small sharp tools are best, right? I want something that does one thing and one thing only and then I take ASCII and make it ridiculous homographs.  And it's got two modes. The first one is just literally it maps every character to a random homograph for that character regardless of how it looks. And the output can be pretty ridiculous. This is what you saw in that last example in plagiarism detection, right? It just spews random unicode at you. The second one, the second mode is called discrete mode. And it's meant to be more subtle. It's meant to like make homographs that look good in context. And you can tell from that second screenshot there it's not very good yet. And that's because discrete like well hidden homographs are really hard. They're sensitive to what the font is. They are sensitive to like things like the background color, the spacing, the kerning, like all of it. And so my goal eventually is to be able to get, you'll be able to give same same hints about what context you're looking for. So you will say like give me discrete homographs for a sans serif font or for a bash script or for like insert random website. And you'll be able to like use that to adjust what homographs it picks. But we're kind of a long way off. One note, I'm releasing this not only as open source but as public domain. It's released under an unlicense. So you can pull us down and do whatever you want with it. I'll be making, marking the repo public sometime this weekend. The, it's also one I'm going to be actively developing on. So if you're looking to get involved in an open source project and you're looking for one that is a very small use and understand. B has a very small community of cool people who are very nice. And C written in rust. This might be the only project you can find that will, that fits all those criteria. So what about defenses? I'm a blue teamer in my day job. Like I like protecting things. So I want to make sure I leave you all with a way to stop this stuff. And the existing defenses on homographs are all very context specific. We saw punicode earlier, for instance. There's also things like code linters that can like remove unicode characters from code, things like that. But the key thing here is you kind of have to tailor your approach to every particular place you might find homographs. So what if we could reliably interpret the visual intent of the payload rather than the actual data? Like these things work because our human eyes lie to us and tell us it's normal English, like normal ASCII when it's not. What if we could have a computer that's eyes lie to it the same way? Well, guess what? We already have OCR, right? Like optical character recognition is meant to turn images of text into text. Well, cool. Let's go ahead and try that. We're going to try and take a homograph payload, take a screenshot of it, and OCR it and just see what happens, right? I want to make one note here. What you're about to see is entirely off the shelf software. I wrote no custom software for this. I am a Linux command line nerd like in my like the depths of my soul. So everything here either ships the boon to or is available in public repos like apt. Cool. So I have a payload. All of that is unicode above the ASCII plane. It's not and you'll see here. There's no ASCII here. It's all just UTF-8 bytes. So I'm going to go ahead and take a screenshot of it. You can see the screenshot I took. Nothing up my sleeve. Not that I have them. But then we're just going to pipe this to existing open source OCR software called OCRAD. And OCRAD needs the image in a certain file. That's the format. That's the PNG to PNM thing. But look, like that worked. Like just the open source stuff managed to take this homograph had no ASCII and turn it mostly back into ASCII. Like open source software and 15 minutes of work got this like 80% correct. If we actually want to build defenses like this, this would not take much and it would work way better than whatever else we're doing. So the key thing here is like the tools already exist. We already have the power to stop a lot of these homograph attacks. Though I don't have the power to get back to my slides apparently. So why I prefer this to alternatives? So there's some pros. Number one, it's context independent. If you can take a screenshot of it, you can do this, right? So that's pretty much all text, right? Second, OCR is a well-understood phenomenon. It's actually something that we've put a lot of research into. I think OCRAD is like 15 or 20 years old at this point. I have to check. But this is not new software, right? It's just no one's bothered to apply them to homographs as far as I can tell. OCR friendly fonts exist. We can actually in the background render this into an OCR from the font first and then like screencap it, OCR it back to maximize our chances of getting this back out to like harmless ASCII, right? And then what you get back is actually the like legitimate text, right? It's a way to kind of defang all these homograph attacks no matter the context they're in. But finally, the piece I like the best is that it exploits attacker incentives, right? Like attackers want their homographs to be subtle, hard to tell apart from normal English. Invisible if possible, right? Well, guess what? If your homograph attacks are perfect in that respect and you can clearly not tell them apart from English, OCR is perfectly reliable or pretty close. And the better the attacker does, the better OCR does at defeating it, right? Like this is one of those beautiful cases where like a skilled attacker would need to make their attacks worse to bypass this defense. And I think that's amazing, right? Now there's a big con with this, which is that for a lot of large systems that are sensitive to like marginal cost of data, like if adding the next data point is expensive and you need to add more expense to it, that might not be a problem. Like OCR can be expensive on large data sets, right? Because you need to actually like engage the GPU to do the analysis and all that. So like it might not work if you're doing like extremely large machine learning systems, right? But again, I think there's a valuable lesson here, right? Which is that defenses work best when they directly exploit attacker incentives, right? This is one of the things like, again, as a blue teamer, I will yammer on four days about knowing your threat model, right? Know your threat actors. Who are you trying to stop from doing what, right? And that involves knowing their incentives, knowing when their attacks work best, right? If you can tell your defenses so that they have the similar incentive, then you are like on the first solid step to actually like winning that engagement. Okay. I have some conclusions. Number one, phenomenology is king. Phenomenology, again, is the philosophy of human experience. I'm a philosophy dork from like my college days, misspending my youth. And basically like human beings are really what gets hacked ultimately. Like we focus on the computers a lot because they're fun. But ultimately it's the human beings that are the standard by which we're judging whether this hack worked or not. And like I said, like hacking computers is fun, but hacking the human being is far more effective, right? So anytime you trick the person, they'll override the computer. Like we've seen this time and again where you flash up a security warning and the human being goes, no, I know better, click, right? So if you hack the person, you don't need to hack the computer. And finally, Unicode is a delay for monstrosity and I love it. Okay. I am not standing here purely by myself. I want to thank my Amazon colleagues who are here to support me, especially David Gabler who couldn't make it. Nikki Parek. I would not be here without both of their hard work. My additional pay phones crew. Make some noise. These guys are awesome. Like they are, they are the shoulders on which I stand. I've learned so much from them and I would not be here without them. And finally I want to thank all the DEFCON organizers, goons, crew, et cetera. It is amazing that they managed to pull this off year after year. It's fantastic. They do an awesome job. So thank them. Okay. And I actually have a fair amount of time. Five-ish plus minutes for Q&A.  Yes, question. Yes. That's a great question. So the question. Yeah. Oh, great. So yeah. So question one was since I was doing this all about English, could we just check to see if it's asked or not? And the answer is yes, you can. And like there are some sites out there that that's their only defense. But the problem is that the internet is a global thing. And as hackers we should all be big fans of internationalization. The internet is for everyone or just for none of us, right? So you do want to internationalize stuff. And if you want to internationalize stuff, you can't just rely on ASCII, right? And the second question if I'm getting it right was will this be an effective defense on things like obscuring email addresses on websites to like avoid like spammers and scrapers? Yes. Most of them are also not very good. Again, most people who are scraping websites to harvest email addresses are actually like they've got a fairly simple business model that relies on high numbers. And they're okay if you if people like get opted out because they can't figure out if it's an email address, right?  So I think this would probably be very effective. It would be great if the spammers then had to do the same OCR defense to like sanitize their data, because that would be heinously expensive and they have a raise within margins. So they'd probably put them out of business. So other questions? Yes, sir. So the question was this can be used in the other direction. So if I get your point correctly, this can be used for like testing and like red teaming stuff. And am I talking to Dave Kennedy for inclusion the SCT? I'm honored by the question. The answers are respectively yes. I think this is very a very powerful tool for red teamers. Again, as someone who's like might as well have like blue team knuckle tattoos. Most of what I have focused on is just lull I broke some stuff that's fun. Let's say I stop it. But yeah, I can definitely see like inclusion the SCT, I think it would be a very valuable tool. And if Dave Kennedy wanted to reach out to me, I'd love to meet him. That'd be awesome. Any other questions? Yes, sir. Sure. So the question is how did I get interested in this research? So fundamentally, again, like I have a philosophy background, and I was fascinated by human perception and how our brains lie to themselves, right? And this was actually triggered by a offhand comment made by Max Temkin on a podcast I listened to talking about the plagiarism detection stuff and how sometimes surrounding a passage of text with white one point font quotes would trick it into thinking you were legitimately quoting an author. So you could hide chunks of plagiarism that a human being couldn't see. So that combined with I used to work as a browser dev and homograph attacks again, tons of them in URLs that's like where this kind of got to be part of the research. So I got very interested in that from an on that angle, but I mostly picked this thread up as personal research in the past kind of like year or so. And I literally just I fell down the rabbit hole where I was trying homographs on everything. And the amount of stuff I was breaking delighted to me. And so like I really wanted to share that hackers delight of like here is a tool like if you take away discrete examples from my talk, that's great.  Does they answer your question? Awesome. Any other questions? Yes, down the front. Oh, so he's asking how I actually built the homograph bomb that was hello world but a half gig. So I did a bunch of different ones. And like it's interesting because I wanted ones that patted out the size but didn't visibly change it and also didn't make things choke by themselves. So it turns out if you put a lot of unicode control characters in like the right to left character things like that, there are some rendering libraries that will just strip those out or like there's some sites that just choke on those on their own you don't need the half gig. So what I finally settled on was a combination of a bunch of combining accent characters interspersed with zero width joining characters. Zero with joining characters could be a talk on their own. They're literally just a white space character though they're technically not white space. The unicode spec is very clear. It is not white space. Don't treat it that way. Literally the only thing it does is tell you at the end of a line, don't break this word, right? It's a word joiner. Keep this word together as you render this text, right? So they're almost never used. They're like mostly used in like type setting software and things like that. But so many places just don't know what to do with them. So they treat them as white space. Depending on your Python interpreter, if they count as white space, their zero width, you can have tons of fun. You can cause your like no end of headaches for people as they try and figure out flow of control issues for days. So. Okay, that's it. Thank you so much. Really appreciate it.