Good morning everyone and welcome to the village talk area. I am Tony our tough nuts when with the packing hacking village We are just across the way come please and visit us And it is my great pleasure to introduce Will who is going to be talking about some stuff You've found about leakage of data and social media So without much to do if I could get everyone to please sit down Hold on D9 Can you there we go and will with that thank you very much here you go hi Could I get a show of hands in the audience those of you who use reddit? Awesome keep your hand raised if you subscribe to the DEF CON subreddit Good and one last question Of those few keep your hand raised if you post or comment to the DEF CON subreddit Not too many just one. All right, that's okay Yeah, I was hoping for a few more, but that's okay. None of them are here. We can talk as much as we want about them Yeah, so you've probably read the program this talk is about me spending the last 12 months Call it what it is stalking the DEF CON subreddit Seeking people's personal information that they might be leaking online So yeah, thanks for coming Language warning maybe information warning definitely Particularly anyone who had their hand raised in the last a couple of questions There is a small chance that you individually may be on these slides in the next 45 minutes or so But don't freak out I've done my due diligence due diligence. There's plenty of black text or all of the slides So you probably want you to recognize yourself Yeah, I just wanted to say before I started as well, this is meant to be a no prior knowledge required speech. So If you have any questions, can we just leave them to the end and I'm happy to answer them after that Let's get on with it. Yeah, obligatory intro slide. My name is will from Australia I work for a cyber security firm there my day job is actually Not related to this at all. I work in cybersecurity in the supply chain So if you're looking through the brief and you're wondering what the hell is this got to do with that?  I have no ability to to wrangle dot large data sets so yeah, if you're in the audience and you are Professional in any of those areas. I apologize in advance. I'll probably butcher your Your fields of expertise and misrepresent entirely, but yeah, I Just I didn't have any of that stuff and just had a crack at it anyway So this is my second Def Con. I came here last year. It's like a bucket list thing with a few friends We went and visited the wall of sheep if you haven't been there recommend doing it at some point in the conference And we love the idea of like a practical way of kind of showing people What they're leaking on a network an unsecure network and Yeah, we thought that was an awesome idea and Like like most things after a few refreshing beverages. We kind of thought I thought to ourselves. That's a really awesome idea, you know during the conference Showing people over those four days. What kind of stuff they're leaking But what about all the stuff that people are leaking? 365 days a year Sharing on social media everything about themselves and Yeah, from there. We were like Wouldn't that be a cool way? Wouldn't that be a cool presentation to sort of collate all that information? And yeah present it back in a kind of like wall of sheep online edition. So that's what that's what we kind of came out So this is what we're going to be talking about. What would a wall of sheep online edition look like? Starting with my most overconfident plans, you know Someone with no ability to do it deciding to go and do it Yeah, what even is a leak took a little bit of time to kind of like have to work that out I had no idea what I was looking for Or defining what that was going to be Needed to learn the recon game Had no kind of clue what was going on there And then sort of like the rest of this talk is really just talking about how I started hunting and gathering and finding those people And then I promise if you sit through all that The last few slides will be talking about Sort of the most juicy slide packs of people that I found Yeah, so I was like how hard could it be, you know, everyone knows people leak stuff online. Everyone knows People overshare all the time social media these days has us lulled into this idea that you know Oversharing is what you should be doing on social media So I was like I'll just find some target group Come up with some things to look for and then, you know, manually sift through and just try to find Interesting folks and then short list those people and then monitor those juicier profiles And that was kind of it from the beginning. I was like, you know Had no real grand plans to actually do a talk like this It was actually just for shits and gigs and in the sidelines And then just sit and wait essentially see how long it took and then at some point We're like, oh, yeah, wouldn't it be awesome if we actually just went after the Defcon community instead of just any random community For a few reasons So as you're probably aware if you are all those people who are in the Defcon subreddit There's also a whole bunch of other social media platforms that the Defcon attendees like to use such as the forum such as the discord And yeah, and the reddit group. So all of those things kind of is really helpful because they all have, you know Great history. There's heaps of discussion on there. It's all different types of people on there different skill sets And one really awesome thing about you hackers is you like to reuse your handle everywhere So that was really good to kind of like just track people across those three different areas And also it's on topic But yeah for the rest of the brief though, I actually just focused on on on the subreddit So yeah, where the hell do I start? I was like It's one thing to sort of come up with this idea that wouldn't it be funny to scrape to scrape a whole bunch of social media But without any kind of idea of what to do or where to find the information. What am I even looking for? I was kind of like in a in a bit of a pickle in terms of actually actually starting So yeah, we're all kind of aware of what PII is personal identifiable information I was pretty I was pretty full bottle on what like what that kind of meant, you know, your name Data birth social security number you guys have all that kind of like basic stuff. I was pretty sure I could find that kind of thing But what about all the other stuff that people leak in terms of like their own personal information? It was kind of a pretty pretty wide scope and I didn't really have much Direction as to how to sort of define it or where to find it or any kind of like ability to do that at that stage Fortunately back home At my company, I had a guy who's sitting right next to me who has a PhD in cognitive behavior therapy a cognitive behavior and sort of Is a proper proper scientist Regarding that and he was actually researching at the time the the tendencies the language and the behavioral patterns of people proceeding of sec incidents and so I was like Riley tell me how to find this stuff or how to is there any manuals tell me how to like search for it And he pointed me down the track of you guys have some amazing resources here in America your three letter agencies like CIA FBI the National Center for Canada intelligence all have really great Manuals and doctrine online, and I was like, oh, that's a really great place to start And not sorry not to get into the social engineering community here I was an all really awesome treasure trove of sort of ways to find individuals and sort of target individuals So I used all that all those kind of Resources to kind of guide me in how I was going to find this other kind of information beyond PII And Yeah, I came to the they were all sort of pointing to the idea that there are these sort of like vulnerable sort of personal vulnerability traits Or more easily manipulated life situations or sort of like leverageable information Yeah, like, you know the Russians call it Compromat And I was like, ooh Compromat I think I'll add that to my my list of things I'm looking for beyond the sort of normal Names and addresses and things like that And my kind of simple mind could sort of track that as a kind of like easy way For an attacker or a malicious actor to search for, you know stuff to find like a soft target. So it's like that that makes sense Yeah, so I come up with this idea of this term called PVI personal vulnerability information. You heard it here first As opposed to traditional PII so traditional PII so there's like Super basic attributes that we're all kind of aware of and that organizations and governments government policy like to or Have in their in their policies to protect And your standard security awareness programs also have this stuff in it as well it's mostly, you know, don't put this stuff online, but if you compare that to all the other stuff that are people leaking and You know, isn't necessarily protected by this legislation or policy You kind of have to ask yourself like which one do I which one would I prefer to see in a leak? And also which one what am I actually leaking myself all the time? See I was beginning to see I was beginning to learn that PII is sort of like just scratching the surface in terms of like online targeting of people Yeah, and I was really realizing that like the real bad dudes out there are actually searching For people who maybe will leak rather than people who already have leaked And so if you think about all those things on that original slide I was talking about all those like PII versus PVI all these stuff that you might be leaking in the blue column over here have this like Provides an attacker with options to target you So it's like who are these bad dudes? Who are who are using this kind of stuff and in all of the research that I was doing? I was realizing that you know, it's not just the usual suspects that we're talking about here I'm not just talking about APT's and hacktivists. We've all heard the stuff about you know Online radicalization of young jihadis and things like that Which actually also adding, you know stalkers Jellisex partners child predators all of these other malicious actors online who are using the exact same methodology Of trying to find vulnerable targets Using the language that they're they're they're presenting online Yes, I had the what I was like, okay, that's great I'll be searching for actual facts about people and then kind of like personality types language use and those kind of things Now how the hell do I find that stuff on you know? Large large space of information So if you've been working in cybersecurity for a minute, you'd be aware of the intrusion kill chain Just wanted to put that up there We are definitely in the risk-consonance phase here just researching identifying and selecting targets And I was kind of trying to work out like how I was going to do this So I just decided to smush all this kind of like all these different organizations methodologies into one kind of Into one like my plan So use the CIA's Methods of like spot-assess and develop and also mixed in a bit of like the military concept of fine-fix finish and using those things Using those resources Online like particularly want to add the Department of Justice has awesome Annals of you know cases Here in America or like they kind of document exactly how espionage cases unfolded and how those people were approached online Yeah, and I came up with the idea of like fine-fix follow which I realized is just It's just pretty rudimentary, but sorry fix fine-followed so I fixed Chose the haystack chose the DEF CON subreddit It's gonna find those people using those terms amongst the anonymous users anonymous users And then assess for leakage leakability and tag those people from monitoring And really at this stage. I was just doing this pretty rudimentary just control F, you know finding Finding words So it's pretty basic at this stage Yeah, so sort of coming to the part where I started started doing it So had to have some assumptions to start with was deciding that like people who reveal in DEF CON Sorry reddit slash DEF CON will reveal elsewhere as a pretty pretty basic kind of assumption If you're not aware the DEF CON Reddit is pretty small. It's pretty small traffic a low traffic So compared to other other subreddits around there and it's going to be a pretty small percentage of those person those users posts So I was like, okay if I find situations in that I'm just going to track where else they're posting and try and find more information from that point Yeah, people who reveal big things probably do small ones also. That's a no-brainer. There is going to be old information. It's a very old you know It's not very old but as years go by there's going to be stuff where people have changed Changed the information that they that they're presenting And of course there will be deception because you know realize you guys you hackers a slippery bastards So it's really just searching for things like I work for my email addresses My name is and I live in realize that's pretty pretty amateur hour But that's just kind of like the small brain small brain position. I was in at this to start with Yeah, scraping was pretty slow had limited results I was really only finding one two three things and sort of just slowly plotting away And I was limited to those keywords what I'm not limited to those keywords But I was limited by those keywords just searching for those few things that I could think of as what would be good Strings to search for wasn't finding me. You know the kind of stuff I was after and at that stage I was Yeah, I was like, I'm not really hacking this. I'm really just like pushing forward But then you know GPT into the chat And I started ask it to help me define those leaky or vulnerable language And really open up those keywords to much more things and even better than I could consider as possible things I wanted to leak I wanted to search for And still some manual sifting needed then to after I found those initial targets through posts But those juicy into group individuals started to grow at this stage. I think I had like two or three people with one or two little posts where I was like, okay, I think I'm starting to develop something here and Yeah, so if you've used chat GPT in the past you or currently you probably know it does require us a bit of Sort of convincing to get it going. I had to kind of convince it. I was reviewing my own chat logs Make sure I wasn't revealing any personal information And it was quite happy to come up with you the things that I should be looking for to try and find PII and PVI And I was like awesome Can you but can you give me the sort of like words that might precede a leak? That would be a bit more helpful than just give me the concept of the kind of things that people are looking for Yeah, and I was like, okay, can you give me a hundred different versions of that? Which was which was really helpful because that I could sort of just still doing my control F still looking through At some stage I discovered there's like a A year ago. It was still functioning was a push shift IO, which is like a website We could do live queries of of of reddit data And I was just really just mandrically going through and inserting these keywords in there and trying to search And then going back on to the subreddit and trying to find the information It was still very very clunky as you can imagine Some of these keywords were some of these sort of preceding strings aren't exactly the kind of language that people are using in the DevCon subreddit like, you know, I Received an email from just not the language that's really in there But I was finding some stuff here and there Yeah, everything was going pretty great Until if you're if you if you're a user of reddit or if you're aware read it halfway through last year or halfway through this year It's just decided to cut all access to third-party apps and my super powerful search tool just kind of went dark and I was left sort of Motivation died regretted not submitting that I'm not Finishing earlier not producing any slides but already had already actually sent this presentation to Defconn. So I was like Had nothing And I was kind of like six weeks of just like whatever was a smart idea. Well, I thought it was a smart idea to begin with and I was like probably not going to be possible now, but then from total failure I Realized that some saint had been Archiving reddit data since the beginning of time. So there was literally Every single post every single comment that had ever been made in reddit In one gigantic text file And so I was like sweet 50,000 comments 6,000 posts now. I wasn't just looking at the last 12 months. I had 18 years worth The reddit the site the reddit. Sorry the Defconn reddit doesn't go back that far But now I was really just looking at you know a decades worth of comments Which gave me a map of much more big. Sorry a much larger data set to look through Yeah, sorry. So at that stage I was Yeah, so I'm sorry. It's kind of One of the problems with doing one of these briefs is going to remember what you're doing 12 months ago Now I was working with a text file. So now I'm just really just searching through a text file You know using Python to just search for strings within the text file rather than looking on reddit online using search But yeah at some point during the year. I was listening to Darknet Diaries episode big Darknet fan And I was listening to Sam Bent who he presented last year at Defconn. He was talking about how he was using he was trying to circumnavigate the The US Postal Service to send drugs through the mail and he was trying to work out how he was going to do it And he was like well one of the you know one of the things best things about the postal service is they have a manual online For what good looks like what they're searching for and he was like I'll just do the opposite And I was driving along. I was like I think I could just do the opposite So I went online to The Australian government website to try and find like the kind of attributes that they that they are looking for when they're trying to Give people security clearances or though or they're looking to give people security clearances And I was looking for attributes For people in that sense because I was like well, that's good.  Give me give me all the synonyms for all of those things And then also give me all the antonyms for all of those as well So I came up with a huge list of antonyms of like the types of people that I was looking for online And then I was like find me all variations of that So sort of like just punched out hundreds and hundreds of of different sentences Which might suggest the type of person who you know presents that that kind of those kind of characteristics And yeah now I really felt like I was cooking with gas because I was not only searching for these things I was searching for sort of permutations or variations of those Just little chunks of those and I was really Finding a lot of results using this method Yes, so I also wanted to find those leak facts. So thinking back to the beginning. I was also trying to find PII So, you know from a slow and sort of like noisy scrape I was now using those kind of that you know GPT enhanced powerful semantic search to try and find words Which sort of seemed like the person was either going to leak or had leaked The search method method didn't change for using the PII I Just had to obviously assess the peak that the leaks impacts There's some stuff that people are leaking is really just sort of basic stuff like down in this green area You know just put this together to try to like kind of Visualize the how I was assessing the kind of things of people leaking That's kind of what I call this death by a thousand likes because Lots of the stuff sure whatever it's just online But you know when you when you add it all up it really is and has an accumulative effect Yeah Yeah, so I had to assess the impact But also like the frequency if you if you're you know If you have 500 comments of in the in sort of green yellow area Maybe that's sort of only worth like one comment in the in the red in the red area There's still heaps of error as you're probably aware Chachi Pity made a lot of things up a lot of the time And it was still very human driven. I was still searching through and finding I Still had to go through and look through the results and actually kind of prove or disprove whether whether it was actually what I was looking for Yeah, as you could probably imagine 18 years is a long time I had lots of false positives lots of like comments that people were making and I was just like no, that's just that's nothing So that was taking quite a lot of my time. I was taking quite a lot of energy and It's pretty boring looking through lots and like hundreds of false positives. There's lots of non-repeat offenders So like you might make one mistake like one time ten years ago And post something about yourself and I was sort of like wasn't interested in that And there was lots of target drop-off as well. So like lots of the people I was looking at So lots of the results was happening a long time ago There's people might have just like moved on and not even been into security anymore So I kind of wasn't interested in that The one thing I want to say about that is like it's it's only about in this context, right? So I'm trying to find people I'm trying to produce slides that are interesting for you guys to look at if it's a malicious actor It's like those stalkers or predators or whatever or you know more advanced enemies We're like you need to imagine like they're only they only need one slip up or one thing that they're looking for So it's only about in this context Yeah, and today we're only gonna look at high-quantity packs I didn't really put anything together where someone had just made one slip But I was also thinking now. I'm actually you know now. I've got big brain big brain mode and Then yes sort of like a couple of months ago as you're probably aware Open AI gave us access to the API. So this was huge. I was like whoa God mode. I was now able to just plug the data that the massive text file of all of those comments straight into the chat GPT Prompt and just literally ask it questions about about the data Yes, I was as I said at the start. This is meant to be like a no no prior knowledge Brief and I certainly had no prior knowledge before I started it But what it meant was I didn't have to like search. I didn't have to produce any search scripts anymore I was no longer in charge of coming up with creative versions of the kind of stuff I was looking for I know no longer needed to Yeah, sorry I said that I just all left it all up to all up to the all up to the large language model, which was awesome It was just There's really limited only by tokens if you're not aware when you're asking it questions You are limited by a number of characters in and out But they really only just slowed me down I just had to like chunk up the data into smaller pieces and re-ask the questions over and over and yeah, and in the in the meantime in the meantime since creating this brief and you know Open AI forging ahead with its with its speed of technology now that that that characters is That you get in and out has multiplied by a factor of I think like six or eight. It's like huge number of a Huge token limit now Yes, and now is that that's an example up there of like the kind of things I was asking I was like, okay, so hey this Data set that I have is a huge list of it's like a it's a play of people who are preparing to go to a hacking conference Some people in there are really awesome saying really positive things and some people in there are kind of like exhibiting narcissistic or psychopathic kind of like Traits give me a list of the top five and it was just like an instant. There you go. Here's your here's your five top targets Which was sweet, I was like, okay, so in the data give me a list of users Suggests that that are suggesting the propensity to commit crimes Show me where they live Wasn't actually showing where they live But it was sort of saying like show me all the users that talk about a town name city name or anything like that So if you can imagine comparing to back when I was previously just using Python to search through I would have had to look through in terms of like a dictionary search of every single town every single place But obviously, yeah, you know chat you can do just knows and goes hit here all the people that say where they live Show me users that suggest fear Yeah, this is interesting one show me for a specific user over the last 10 years When they're online when they make their posts and finally I was like show me anyone who's looking for anything Who has posted anything about work working on anything special or out of the ordinary at their work? Yeah, so I guess the concept of The speech that I'm trying to give Trying to get across is that the barriers of entry are completely gone All those questions that I was asking in the beginning of how am I going to do it? You know what even search terms am I looking for what comments? What about things that don't match the terms? How do I how do I do it at scale? Where is it centralized and when you know when to do it all of that stuff is completely gone? because of all of these things that make up what we would what we consider like the Capabilities required to do that They're all inherent and anyone here can can literally go online and and do online targeting of people You know with absolutely no experience whatsoever Yeah, and some of my rehearsals someone was like how can't you keep it for just do this now? Like he does plug-ins that you can just connect to the internet and you can just do it But unfortunately, it's quite resistant to this kind of these kind of questions No matter how hard I tried GPT-4 is not happy to do it So, you know getting the data saving the data down getting it offline putting it on your computer And then using the prompts to scan through it much more successful and now Let's talk about I think I've got like five or six target packs here that I'm going to talk through Before I start I just want to have to make a few caveats To to the things that we're going to look at Certainly, this is not a Representation of DEF CON attendees at all like just like you know any subreddit anyone in the world can join up I think it has like 30,000 members So it's definitely not a representation of of you guys here today With the other One second, sorry Had some very important caveats. I wanted to make oh Yeah, sorry, so the people who are up here obviously have their own make their own decisions They have their own threat model their own thresholds of like what they want to reveal online Probably have their own understanding of like how much they have revealed Oh, yeah, and one other thing is on the fly out over here I had a lot more information on these slides about what they what people have posted But I had kind of like a moment of clarity where I was like well, you know If I put up any one thing that they've revealed that kind of reveals everything So I did a lot a lot of blurring on the way over here. So Apologize if it's still too blurry for the kind of blood that you wanted to see But you know people's privacy also in an area like this is is important Anyway, let's get on with it So the first guy or girl The AI hit for email addresses containing first name last name Wanted to see talk about any illegal activity. I asked it to find comments about suffering and also any kind of You know device information or models of modems and things like that So the first person, you know quite a lot of hits here Route a brand model drug use You know, I'm not I'm not here to pass judgment on anyone using drugs or whatever But you know if you are going to post that in an online forum You know with all all kinds of actors looking at you judging whether you're a target And you're going to kind of reveal that there are moments of vulnerability about your about your life That could be it that could be a that could be a valuable data point This person's right into conspiracies, you know very easily manipulated. I would imagine Crypto bro. Yep, and the other thing was yeah So like one thing if you think about like malicious actors trying to trying to contact people or trying to like have it have a Pathway to conversation. They might have to choose between a bunch of like their hobbies or interests You know a short a shortcut or a cheat code to that is like if they're actually like seeking a mentor So this person, you know, not too much here But quite a lot of quite a lot of attack pathways Yeah, so this one this one I do I actually Pulled a lot down because this person was actually posting a fair bit about themselves But this one's going along the lines of like that's the stalker kind of threat So the individuals posted, you know their home location where they live But also, you know, their name age backstory quite a painful past lots of like Experiences of racism and things like that that that an attacker could look kind of used to build rapport But the other thing they mentioned was they're traveling alone to Def Con And was we're going to be at location ABC, you know And if you're you know a female traveling alone and you're going to reveal everything about yourself and your backstory as well as you know Positive ID of what you look like it's quite a lot of stuff for a quite a lot of sort of opportunities for Someone who's trying to you know go after you to to have you know in their back pocket Yeah, this one's interesting one. So this one Chatchapiti hit for weekend activities small towns and use of their first name So it wasn't a lot of things but you know after icon was like triaging through this is kind of like a very efficient and Minimalist kind of pathway to an attack So if you're going to talk about the city or state that you live in particularly this one I think that the population was like under a hundred thousand But also talk about a place of interest that you and your family visit on a frequent basis And finally talk about your vehicle description right down to You know decals and stickers on the back of it if someone you know had that kind of information They wanted to sort of get close to you or get close to your house That's all they would really need To to target you from from a from an individual perspective Yep breed of pet Sure, some of the slides have that kind of stuff in there not just talking about you know Those standard don't do security things like tell people your secret questions But if you're going to talk about your breed of pet Think this is like the French Bulldogs something to do with like every Every pet I've seen and Defconn is French Bulldogs But if you're going to talk about that, you know You're opening yourself up to pretty pretty effective spearfishing and things like that Person's also very open to online comms Yeah, so this guy hit for got a security clearance I live in ex-location and ranks. So this is a military person You know posted to a certain location Revealing their career goals, you know if a tacker is thinking about, you know Everyone has something they want or ever that they're going after if you're gonna reveal your goals That's kind of like an easy kind of offering for you Talk about their career timeline grievances at work military rank and their workplace and their Openness and and they're kind of like approach to authority. So Quite a lot of stuff here. I Realized in America, you guys have a little bit of a different approach to how you how you conceal security clearances and things like that In Australia, it's fairly it's fairly It's very different it's a different approach to how you how you manage your security clearance Yes, so this was this one had quite a fair bit. So I was looking for I found things for gains seniority specific device Specifications and things that they were struggling with So, you know the AI found are quite a lot of things Across these across the post from this person particularly the pet name breed Became a senior manager quite quickly If anyone here is you know just to expound on that a little bit I imagine they're probably people here who work for companies that have you know significant IP that they want to protect Or maybe you want to work one day for companies that have IP. They want to protect You know moving up in management in those in those companies is probably something that an attacker would be looking for if they're trying to Like assess your ability and what kind of stuff you know about that company Yet revealing router brand model. I'm not a hundred percent sure how bad that is you guys will probably tell me Personal demons where they live and also painful past person experience quite a lot of bullying and particularly the number of posts With regards to this was pretty high So, you know in terms of like building rapport and kind of like getting alongside this person I would imagine that you know an advanced attacker would probably have a pretty good chance from from that from that angle and Last but not least. Yeah, this is probably one of my favorites This guy posted one time in the entire 18 years of the subreddit posted one time first name last name at whatever.com and And I just googled that and straight up pictures himself at work ID card You know, I'm not assuming that this is any kind of like high security area and that this is a massive security breach But you know if you only discover to the to the physical village You can probably you can get some information about like just having the picture of the ID card Usually will get you or like if you just create an imitation ID card. That's like a that's like a pretty good Bit of information to have if you're trying to get into a facility. So yeah, don't post don't post pictures of your ID card Yeah, so those individual Target packs only revealed Only revealed small things Individually what five or six different things But I kind of encourage you to kind of think about your own social media And not just your reddit posts, but every other social media that you use And think about whether, you know, you had more than or accumulated measures Accumulated version of those target packs and how much information a person would have if they were to just use something like AI spend a bit of time and create You know create a target pack surrounding you or you know individuals that you love or or colleagues This isn't a real person that's an AI guy But yeah That's the end of the speech. Does anyone have any questions? So did you validate the data that you get it from charge APT? So is it real is the data in the data set or charge APT just imagined it? Sorry, I think I understood your question. They're saying did I validate whether that it was accurate what it was finding versus? Yeah, so as you can as you sort of saw in the some of those slides had like what The output of the search was and like the black terminal kind of section But then I went back on to reddit to kind of spread screenshots make it a bit more a bit more User-friendly in terms of a speech But yeah, I did go back had a look at what it kind of like what the con what the comment was in context And that kind of but you know it just added to the amount of time that I had to spend doing it But yeah that required human human interaction. It was not really possible to just To just have it completely automated And see a question any others Okay, yeah, so the question was what what was the most common leak that you saw over and over again? Yeah, so these were like these are these I you know I chose these because they're like the the best ones up there for kind of like a broad spectrum of things that people were leaking Didn't see a lot of like personal names Like I was saying at the start the Defcon subreddit was actually pretty hard to do like some of the other ones that I was looking at like r slash cringe and r slash NFL like I was just sort of like wanted to see how bad This subreddit was versus other others and it was really good. So it was very difficult to find Much information in there. I know it looks like those few slides there was lots But I probably had something in the realm of like Maybe 20 or 30 which I thought would be would be good starting point and probably yeah There wasn't a lot of like first names a little last names almost zero like addresses actual addresses There was just lots and I think that the PII I think was probably fairly covered by people I think most people understand and not put those kind of like in actual facts about yourself in there But the thing I did see posting over and over again was like Yeah, personal like sort of like own Feelings own mental state. That's the thing. I wanted to mention actually like the mental health slide the mental health I think it was like one of the first or second slides had as someone was discussing their like mental status It's kind of like a really That was a difficult one for me. So I was a bit conflicted about whether to put that up there because you know a lot of people use Talking about that kind of stuff in a in a forum to kind of like help them get through it But you know particularly if you're thinking if you have a heart if you have a if you believe you have a high threat model You know revealing that kind of stuff to the entire world that you are potentially compromised in different areas You know, it does open you up to to being to being manipulated in that way or being attacked in that way But yeah, I can't think of the top of my head apologize What like the most frequent one was maybe yeah, maybe that's a good thing to do next It's kind of like work. Yeah, where the where the worst where the worst leaks are happening. Thanks, sir I had a question about like fact-checking So especially on reddit sometimes people like to role play as different things in different subreddits And you'll see people on one forum saying oh, I'm a software engineer in a different thread They'll say oh, I'm an auto mechanic and they might not be either, but they want to participate in these threads Is there a way that you've kind of vetted information sharing as face fake or true information Yeah, that's a good question.  It wasn't gonna download at all I just downloaded the ones that I wanted to but if you I'd imagine this would be how I would go about it again Not a big not a data guy, but this is how I would do it go to the person find all the ones that they're in and Yeah, go get that text file put it all together and then ask it questions about Things like job things like experience and and you know from the results I got it is fairly capable in doing that and looking through and finding examples of that kind of stuff, but yeah, not I didn't I didn't actually do it, but thanks. Yeah, I Was wondering When you found yourself moving from Reddit to other platforms Do you could you rank the platforms? Which ones people share the most information about themselves on? Okay, yeah, so I didn't search through discord or for all the forums Just because discord hates being scraped and and the forums I didn't actually find that much, you know actual information in there So, yeah No, yeah, thanks All right, I've been given a couple of minutes morning wrap up if there's any one or two questions left Otherwise, thanks very much be an awesome audience


Okay. Hello everyone. Good afternoon and thank you for coming this session. I assume I'm probably on the one who's holding you from ending the day. Anybody have a session after? Perfect. So my name is Ariel. I work today in Cisco in the emerging technology innovation team. I was part of the Portshift. Portrait was acquired by Cisco. We're developing cloud-native security tools for Kubernetes for Istio. And now we're doing it in Cisco. Before that I was the head of the serverless security in Aqua and even before that I work in Checkpoint. Working in some open-source contributions, contributor and maintainer in Kube Clarity. We try to encourage everyone to test and use something which is very useful for whoever's using Kubernetes in production. It's handling all types of software issues from vulnerabilities to signing, S-bomb and everything so you can check and validate it in your clusters. It's a very interesting approach at giving it an accurate snapshot. Never mind the topic of this talk. Also working in the CNCF in different top projects and some contributes to the Mitra attack metrics for containers. Now before I start, just a quick poll with not a lot of people. How many of you here in the audience handle deployment of containers on a daily basis? Raise your hand. Perfect. Thank you. How many of you are hardening the settings of the containers which you deploy? A smaller part. Have you heard of used pod security profiles? Yes. Okay. Perfect. Great. So you're in the right place. So a little bit about the basics of pod security. So we all know what pods are. Each pod has a security context that controls the runtime settings of the pod. Now those settings are very powerful. We all scan our code for vulnerabilities and we really get worried even if we have like a medium or a high vulnerability that's completely irrelevant to the code that we write. But sometimes we don't really look at the security settings. Security settings are defining what privileges the pod has, what capabilities it extracts from the operating system, what volumes it can mount, what access it can have to the file system of the host. So those are really powerful settings. Now the defaults are very permissive. Okay. But if you can, but they can be modified, they can harden and a hardening them can really eliminate, you know, a lot of security pitfalls. It can really eliminate the need to use external tools or governance just by using it correctly. You can improve significantly the level of your clusters. Now PSP or pod security profiles. So we're already designed to control those, the security context of these pods. And the topic of this talk is to talk about, a little bit about it, what it is, why they're deprecated, what they are, what can be done instead of it and how we can really enhance and automate the entire thing. So another little bit look of how does the PSP structure was supposed to be something which I took from the AWS EKS environment. So pod security starts with policy. As you can see in the policy, you can define the spec. You can see this is like an example of a very permissive spec. You can see the containers can run as privilege and it allow privilege escalation. It can use any capabilities from the operating system. It can use it can mount any volume. And even if you look all the way down to the bottom, it can, it doesn't allow, I mean it can do right, has right access to the file system of the host. Now in order to apply those policies, you need to take one extra step and you need to create a role. Okay. And in this role, you need to, you know, define the policies and use them and then create a role binding and then you are set and you're ready to go with the PSP. So PSP was a great initiative. If you want to take a look at an example, so this is an example of the MitreTech MitreTech framework for containers. So every cell here represents a real attack, which was detected in the wild, meaning it's a real attack that happened and can be identified.  So the potential is great. The impact is big. It's really useful. And then one of the questions that you want to ask yourself, if this is really true, then why PSP is deprecated? Okay. Why? We know that it's in Kubernetes 1.21, 1.21, they started the deprecation, probably completely removed from the code in 1.25. And the question is why? If it's such a huge benefit. And I think this is a classical case of great intent, but I would say a challenging implementation. You know, when you really use PSP, and I don't know if many of you have had a good positive experience or not, it creates some challenges.  There is no auditing. So if there is a failure because of the PSP, you don't know that, you know that there is a failure, but you don't know why, what caused this failure, which of course makes it much harder to debug.  So I think, you know, it's really great intent, you know, it was really a good thing to do, but the implementation was a bit challenging. So yes, very sorry, PSP is deprecated, but no worries, there is something instead. So instead of PSP, there's a new security model. It uses similar concept, but slightly different implementation. So the new model simplified the governance of the security context. It creates three default pod security standards that enable three, you know, different levels of pod deployment. We'll touch in a minute, watch each level provide. But I think the most important thing is that users can customize them. Those are just recommendations. You can, of course, go ahead and customize it and create something which really, you know, tune to what you need, what you think is needed, what you think is important. The enforcement is much simpler instead of using role-based access control, using admission controller. And this gives you, as I'll show you, really high level of flexibility and really a very good level of, you know, enhancements.  The more the policies are decoupled from enforcement, you define policies in one place, you enforce them with other things. And this is a great way forward. So yeah, we have enhancements. Perfect. Let's talk a little bit about, you know, the standards. So the standards are accumulative, privilege. Those are the defaults, right? You can, of course, as I said, create your own and customize it, something that fits your needs. But the privilege is all the default settings. Everything is allowed.  Let's party. The second one is baseline, which is minimal restrictions, pretty much. Don't run as privileged. Don't run as a root. No privilege escalation. And the upper one is restricted, which is like implementing the security best practices. Sorry. So starting by Kubernetes version 1 to 22, we're having those three standards which define, you know, the security settings of port deployments. And those policies are cumulative and they start from very highly permissive into highly restrictive. Now, again, if you ask me, even when you do some things in Kubernetes, you still need some marketing, because calling restricted to the policy which really provides you the security best practices is probably not the right way to do it. If you would ask my recommendation, I would say, use by default the restricted environment. I don't think it's heavily restricted. It pretty much gives you, it's follow all the security best practices of, you know, what capabilities you want the port to inherit from the operating system, what volumes you can mount. It doesn't try to just privilege, not running as a root, and not allow you to escalate privileges, which I don't think is a bad thing. It recommended, you know, read only writes the host file system. So in general, my recommendation is, you know, use the restricted profile. Then if you have exceptions, use the exceptions. Again, I think that when nobody wants to be restricted, so I think probably would use a better name for that. But never mind. That's what it is. I think it's definitely a good recommended, you know, profile to use. Okay. Next, let's talk about admission controllers. How many people have experience with admission controllers? Great. Okay. So what is admission controller? Just like, you know, in a very short and brief way, any API request in Kubernetes to the API server has certain stages. It passes before it reached the API server and being executed, right? So like, you know, things like, you know, authentication and schema validation, many, sure, I can do it. Those are important steps. But I think another very important critical step is to use the admission controller. Admission controller allow you to using a web book and allow you to really pretty much validate or modify at the request based on pretty fine policies or pretty fine ones. So for example, you can create a validation web book that any, you know, poll that is asked to be deployed. If it, for example, have critical vulnerabilities, you know, it will not be able to, you might be able to deploy it because every time that, you know, we want to execute a build command, we will check the validation web book, can check and see if it meets the set of policies. So using admission controller is a great way. Using it for security can really provide you an agentless approach. You don't need to deploy agents, you don't deploy site-side containers. You can really use admission controller and govern your entire state of your cluster. Great. Now two quick things. Validate, you know, admission controller has two modes, has the mutating web book, okay, which allow you to really mutate and fix, update, change, modify the request. And it has the validating web book that you can just check if it, yes, no, if it meets or doesn't meet, you know, the need. You can use both, you can use just one, okay, but the idea that if there is an API request that doesn't reject it by any of those controllers, then the entire request is rejected and is not moved to the API server and consequently is not being executed in your clusters. It's great. Now, if you do want to use admission controllers, you can create your own, you can create your own customized resource, but you can use what the CNCF provides. So there are two projects in CNCF. One is the open policy agent, one is Kiverno. Each one of them has an admission controller that you can use for your purposes. So the open policy agent, those are not familiar, so it's just, you know, small introduction. It's lightweight general purpose policy engine. You can write policies using declarative language or regu, okay. And then you can use the gatekeeper as admission controller to enforce those policies. So it's a mature project. It's graduated four years, tons of stars. It can be used. You can see here an example of a policy in regu that eliminate or prevent containers from running as privileged. Of course, you can take it one level deeper and say, okay, it's not running as privileged. Just use one of those standards, either the default or the one which I customize. Okay. So that's a great way to make enforcement to the security state that you want. Kiverno is more interesting. I'm not saying more interesting, I would maybe be caveat. It's another alternative to use declarative policies. Here the policies are not written in regu. It's more like a CRDs. So, you know, it could be like, you know, very simple to ever write CRDs to relay to those policies. And here in Kiverno, you also have an admission controller that can mutate and validate requests. It's a slightly younger project. It's still in stand box. 2.5,000 stars. It's a good start. Okay, great. So we talked about the new model. We know what the security standards are, what admission controller is, what admission controller options we have. Let's take a deep look in implementation. So when we really want to say the model is a great initiative, definitely an accelerate adoption of security hardening. But there are a few items that would love to hear what you think about. I think can be slightly enhanced if you really want to reach the good level of security. One thing is that the current model is restricted to namespace level implementation. So implement a security standard on a full namespace. Okay. And the same security standard applies to the entire namespace. Ideally, you probably would want to have some granularity level, right? You would like to apply a bit different standards to different pods, so you can have like each service or based on the service risk, apply or use different standards. So this is, you know, one option. Another thing which in my opinion can be slightly challenged is the fact that it only uses the validating web book. So we have a binary decision, either yes or no. Is it good or is it bad? If it's good, fine, we can move ahead. If it's bad, we reject it and we go back to give the users, go back and go and fix the failure. And here, one other thing that thought can make it slightly more interesting is two small enhancements. So for example, we can use a hybrid mode of admission controllers, right? So if using just the validating web book, we need to remember that admission controller also has the mutating web book. And if we use both options, for example, instead of just making this decision, which is yes, no, is it okay, is it bad? We can also add the option of fix it. So for example, let's assume that you want to apply a certain standard as a basic. Okay, saying this is, that's the basic security setting. We want all the pods to run in our cluster. Now, if you're using the mutating web book, if by mistake, someone, you know, make a deployment, you know, without remembering what you think is the best security method to use, or just because you use a help chart or use something that you found intended or just downloaded from any repository, then your mutating web book can not just tell you, okay, sorry, you failed, but can fix it for him because this is what you think should be done, right? So the mutating web book give us the capabilities, not just giving you a yes, no question, are you compatible or not, but also modifying it and changing it based on what you think should be the right result. So this is, I think, in my opinion, and a good enhancement to the current model, you know, we'll have to hear what you think about it. We think it's useful. Another thing that can help us to do more customization or more granularity in the usage of the standards is using something like a pod ID, something like if you're familiar with Spiffy, or if you're familiar with Kubernetes labels, okay?  So this way, if you have a service which is more sensitive, you can apply to him a more, you know, restricted security standard. If you have something which is no less sensitive, less important, more closely couple, you can enforce a more flexible and more permissive security standard. So having those capabilities, granularity allow you to get, you know, better fine-tuned policies and again, achieve your results of being secure without restricting a thing that doesn't have to be restricted. So those are, I think, two enhancements that we can, you know, enhance the current model. I want to have just, you know, one word about automation. So we all love automate and we really want to automate and then you ask yourself, okay, but how does what you show here with the granularity and everything can do with automation? So here just sharing something, you know, from our user experience, and again, we'd love to hear what you think about it, is a lot of times, you know, we want developers to own their response, the security responsibility of their service, right? You create a new service, you know the best, what will be the best way or what will be the best settings for it, how you want it to run, you know, what privileges you need, what capabilities are required. And here, you know, using GitOps, in this case, you know, we use the Argo CD, but doesn't necessarily have to be Argo, you can use it, you know, with any GitOps tool, then you can ask your developers when they're committing a code, right? Committing a code which will then go to deployment also to create the security settings or to create the policy that this service should run with. And then, okay, when you create this rule, okay, the defined will be the desired profile that would be, you know, for this service, you can upload it to the Git. Now, when using GitOps, right, the policy rules will be automatically added to your admission, to your engine or to your policy engine which runs in the cluster when you sync your, you know, your Git. So when the Argo CD, for example, sync your Git repo, it will not just push the update of the new code, but it will also push the new policy rule. So in this way, you can really allow developers for them, you know, to go ahead and when they commit code, also commit the security setting of it. And when they're using GitOps, it automatically will apply. No one needs to go and make the fine tuning or the specific policy if you do want to make, you don't have to, but if you do want to make specific policy for this deployment model. And this is something that, again, that can really provide a very good way for you to automate the security and use your developers to pretty much define what's required for them, and you can use it back in your deployment. So if I want to summarize everything, hardening pod runtime configuration has now a new and a friendlier model.  The pod security standards and the admission controller replace the PSP and the RBAC. So the model is much better, is more suitable for Kubernetes. It's much more friendlier and easier to use. It's highly customized. So you can both customize the standards to meet your needs. You can use not just the recommended or the set of validating admission controller. Each of those options, whether using Keverno or using a gatekeeper or you have your own, you can also have the ability to not just validate, but also to mutate. And this unit can really save you a lot of time. And if you're using declarative policy engine and a building admission controller, you can really automate the entire model, as I showed, you know, using GitOps and something that can really save you the burden. Shiftless leftover developers allow them to have a more precise definition. Thank you very much. If you have anything, feedback, comments, would love to hear from you. If you have any questions, we have some time for questions, I believe. Yes. Okay, so I'll just repeat the question. So the question was, if you're using GitOps and using automatic policy, the Git stopped being the source of truth. And I think not because in the Git, you have the policy, you have what you define or the state that you want to run. Now, it's reflected in the cluster. Okay, so the only way is just like, you know, instead of, you know, having the burden of doing it afterwards, you can do it when you make the deployment. And still, the policy is in the gate with the code, and you have this single source of truth. Now, if I understand you correctly, what you're saying is that that's correct. But in one gate, I have part and in another gate repo, I have a different part, right. But I think, again, you're correctly distributed, but you don't lose the gate as your source of truth. You just have the relevant part there. What you can do is, you know, try to define to yourself, at least for the machine controller, what the machine controller is being used with any Git. So you can pretty much restrict it and have a more distributed approach or at least adapt your deployment to that. But yes. But again, I think you still maintain your concept of Git. Okay, okay, okay, okay, understood. Okay, understood. So you're saying what happened if the policy that I have is overrun by another policy, which is the cluster, and I gave the mutating web book to the, to the, to change and modify that. Okay, that's a good point. I think this is maybe a case that you write, and you can use just a validating web book to avoid this scenario. I think the mutating web will give you some kind of flexibility because many of the mistakes they see are mistakes that are not dying deliberately. I think because someone forgot or didn't know or just use, you know, something that you found in a Helmcharp repo because you want to write by himself. And then if you would know, you probably would do it. And in this case, mutating web book can fix it. You're correct. If you want to keep the GitOps more, they need to just use the validating web book. But I think again, it will save you a lot of time to change back. Yeah. Absolutely. I think it's a good comment. Anyone else? So if not, thank you very much. I think I save you five minutes.


It's been a ledge that I used to get kilos of puffin' joe every month.  No, it's your mob, mate. Your mob. Your mob. Hold up! Hold up! Your mob! Don't about asses. Don't cut me short. Don't cut me... Don't cut me short. The kilos only come from your mob. Because even the nurses, the doctors and the admin, yeah, they only bring in the answers and a few pills and a few bits and pieces, but they're big lumps. They come from your mob, mate. Come on, be honest. No, no. Be honest. Be honest. Right, I... No, no, please. Be honest. No, of course I...  I am honest. It's become really prevalent. Right, I left... Like, percentage of prisoners snitching and being sneaks. On each other? Yeah. A lot more than it used to be.  Fucking!  Break it! Break it! Left arm, you mug! Break it!   You know you've took it... You know you've took it from my...    Well, four murders now. Oh, four, yeah, yeah. Why would you go into the police station with the phone that connects me to you? Only a small percentage of these cunts that dig them out. Do you know what I mean?    Do you know what I mean?  He cut his wrist. No, they don't, mate.  The screws do it. My pal would never have killed himself.  No, like that. Oi, cunt! Open my door.  I'm not letting him get away with this. I regret not having a proper life. I regret not having nice Christmases, not being there for my kids.


Okay, last week we worked on linear gradient fills. So we were filling up our full canvas. Really we were filling up a rectangle that was the full size of our canvas with multiple colors here. Well, today we're going to do the same thing, but instead of linear, which is straight across. So here we went from the top left to the bottom right. You could also go directly across rather than angle or whatever angle you want. We go up and down as well. Today we're going to work on radial, which is circular fills. So let's go ahead and get started. I'm just going to start modifying last week since it's so similar. So what I'm going to do here is let's get rid of the colors in the middle here. And we'll just go from blue to yellow, across like that. So we have a rectangle here, which we have set to be the same size as our canvas. By the way, this is a series. There should be an annotation on the screen to the playlist. Be sure you watch the previous tutorials before you continue here. Also, I'm assuming that you have the basic knowledge of HTML, basic HTML, and some basic JavaScript at least. I should have said that like 10 tutorials ago. Anyway, and here we're going to instead of do a linear gradient, what we're going to do is we are going to do a radial. So we'll erase linear there. Capital R, this is case sensitive, radial gradient. And with the linear, we just give it two sets of points. The starting point and the end point. So the beginning left and right X and Y, beginning top and left X and Y, and also where we want to go to X and Y. Well, you actually need to give four different numbers for the radial. So what we'll do here is I'll say 200, say 50, say 10, I'll say 250 and 300. Okay. So what are these numbers? Well, the first number, what we're doing basically is we're drawing two imaginary invisible circles. And we're drawing the gradient between the two. So what we're doing here is we're giving the radius of the first circle and then the X and Y. And then we're going to do the same. We're going to give the radius for the second X. I'm sorry, I said that. No, I said that right. And then the X and Y. So let's go ahead and refresh up here. And as you can see, we have a blue circle fading out to a yellow circle. So let's go ahead and change some of these values. And I think I did say that. I can't remember what I just said, but let's change that to 20. And that would be moving the X and Y. So it's X, Y, radius, X, Y, radius. So how far left the center of the first circle is. So if I want to go further over, I can say move it to 300. There we go. And if I want it to be further down, I can move it to 150. And now it's further down. And its radius is 10, which is, as you can see, kind of small. I can make it bigger. I can make it 20. And if I refresh up here, you can see you got a little bit bigger. Let's do, let's go extreme and say 100. Boom. It's really big now. Let's go ahead and set it back to, we'll set it down to 20. I think it was a good number there. Oops. I did 200. There we go. Okay. So now we have the X and Y of that. We have the X and Y of our second circle here. So let's go ahead and set the X to the same. So they're centered. If we want them to be centered together, we just give them the same X and Y. So the center point of both circles is the same. And of course, they don't have to be. If I wanted it to kind of point in a certain direction, I can change, let's say, I'll change this to 250 instead of 150. You can see it starts to move that circle down further. Kind of giving it the feel like, kind of like it's pointing down. Let's go ahead and change that to 400. I think might be a good number. Let's see how that looks. There we go. So now it's kind of pointing down. Actually, now it's almost looking like it's a ball with some colors there. So that's that. Now I do want to point out that you don't want the... Let me set this to 299 and see what happens there. Not much of a difference. Let's set this to 250. There we go. If you start making the radius of the second circle smaller than what I have found, smaller than the X or the Y of the first circle, you start getting this cutoff. I don't really know. I haven't read anything about that. I've just discovered that from playing around myself. But you definitely don't want that to happen. So let's say I set this to 100 and this to 350 and we refresh. Because it doesn't happen that way. I have found myself and I can't really explain this because I haven't seen anything talking about it online. It's just something I discover playing around with this. If you put the radius of the second circle lower than the X of the first circle, it kind of screws up the picture. Keep that in mind. Now of course we can also... Let's go ahead and line some of this back up. Let's put this down to 200. This at, let's say 50 for that. We'll do the same thing, 50 here. We'll do this at 50. And we'll do... Let's just do like that. So we have kind of a... It's kind of like a sun only reversed coming out of there. We can again add more color stops. So we can say blue, red, blue. Try to think of colors I haven't used. I'll just say green. And of course these values as I said in the last tutorial are anywhere from 0 to 1. Depending on where you want to position based on what we have set up here. So let's go ahead and set this to 0.2 and this to 0.4. And when we refresh now we have... It goes from blue to red to blue and then out to green. And the second blue is 0.4 ways across our total span of our fill. So that'd be 40%. This would be 80%. So you can see it's a little bit further there. And that's also based on the size of our circles as well, unlike our linear which was the entire size of our rectangle. Well, I hope I explained that well. I tried my best. And of course you can always come to our RC channel. I'll try my best to help you again. I am learning HTML5 canvas myself when I'm teaching the tutorials. I'm really only a few steps ahead of where I'm teaching. So hopefully I'm explaining things well. I think there are some benefits of that since I'm learning. It's kind of fresh in my head. And maybe I explain things to someone better than someone who has it mastered. In some cases, in some cases I can say things inaccurately. Also it helps me learn to teach you. So once again thank you for watching. Please visit FilmsByChris.com. That's Chris of the K. And I hope that you have a great day. There should be a link in the description to my website. Again, have a great day.