00:00:01.201,00:00:04.538
>> Hey guys. Uh so this is a 2
o'clock Weaponizing data sites

00:00:04.538,00:00:07.207
through social engineering. And
these are the guys. And we wanna

00:00:07.207,00:00:12.212
gonna kick it off. Say
[applause] >> All right so

00:00:17.518,00:00:19.820
DefCon goons are no longer
allowed to drink in red shirts.

00:00:19.820,00:00:21.889
Nor are the allowed to do shot
the newb. I'm gonna keep this

00:00:21.889,00:00:24.524
short. It is Phil first time
speaking at DefCon. John spoke

00:00:24.524,00:00:26.960
last year but wasn't able to get
his shots. So let's do a shot

00:00:26.960,00:00:31.965
with him and have a good time.
[applause] Don't fuck it up.

00:00:38.839,00:00:41.308
[cheering] >> All right. Hey
guys. Um my name is John

00:00:41.308,00:00:44.578
Seymour. Um so welcome to our
talk on weaponizing data sites

00:00:44.578,00:00:47.915
through social engineering. Wow.
Dude that was strong. Um

00:00:47.915,00:00:51.351
weaponizing data sites through
social engineering automated end

00:00:51.351,00:00:54.988
to end spoof phishing on
Twitter. So uh we think this

00:00:54.988,00:00:57.958
talk is actually pretty good fit
for this conference right? Every

00:00:57.958,00:01:02.296
year uh Black Hat you know does
this attendee survey and every

00:01:02.296,00:01:05.365
year social media you know
phishing spear phishing social

00:01:05.365,00:01:10.604
engineering is near the top of
their lists of concerns. Um we

00:01:10.604,00:01:13.373
wanted to try our hand and see
how effective using AI to

00:01:13.373,00:01:18.211
actually automate spear phishing
would be. And so uh things like

00:01:18.211,00:01:21.014
social engineering took it
actually automates the backend

00:01:21.014,00:01:24.418
of uh you know social
engineering right? So da uh

00:01:24.418,00:01:27.187
creating a malicious payload.
Things like that. We're actually

00:01:27.187,00:01:29.623
interested in more of the front
end sort of stuff. So actually

00:01:29.623,00:01:33.994
generating links that users will
click. Um traditionally there

00:01:33.994,00:01:36.263
are two different types of
approaches to this. There's

00:01:36.263,00:01:39.032
phishing which is very low
effort you know shotgunning tons

00:01:39.032,00:01:42.069
and tons of messages. But it
also has very very low success.

00:01:42.069,00:01:46.573
Between like 5 and 14 percent.
Um there's also spear phishing

00:01:46.573,00:01:49.443
which is highly manual. It takes
like tens of minutes to actually

00:01:49.443,00:01:53.146
research a target and create a
message that's you know uh um

00:01:53.146,00:01:58.618
hand crafted to that actual
person. Um but uh it also has

00:01:58.618,00:02:02.422
very high success. The social
media pen testing tool that we

00:02:02.422,00:02:05.492
released today actually combine
the automation of phishing

00:02:05.492,00:02:08.495
campaigns with the effectiveness
of spear cam spear phishing

00:02:08.495,00:02:12.666
campaigns. And with that said uh
I'm John Seymour. My hacker

00:02:12.666,00:02:17.471
handle is delta zero um I'm a
data scientist at Zero Fox by

00:02:17.471,00:02:21.842
day and by night I am a PhD
student at the University of

00:02:21.842,00:02:24.578
Maryland Baltimore county. And
in my free time I like to

00:02:24.578,00:02:30.484
research malware data sets. [mic
noises] >> Alright and my name's

00:02:30.484,00:02:33.220
Phillip [indiscernible]. I'm a
senior data scientist at Zero

00:02:33.220,00:02:37.324
Fox. And in a past life I was a
PhD student at the University of

00:02:37.324,00:02:39.559
Edinborough in the Royal
Institute of Technology in

00:02:39.559,00:02:43.797
Stockholm. Um so in that past
life I've studied recurrent

00:02:43.797,00:02:47.100
neuro-networks artificial
intelligence but in a much more

00:02:47.100,00:02:50.737
biologically oriented way. I was
trying to figure out how you

00:02:50.737,00:02:53.040
could combine neurons together
and connected them up to

00:02:53.040,00:02:56.476
synapsis and simulate networks
of their own to try and get some

00:02:56.476,00:03:01.048
storage and recall of memories.
Um but nowadays instead of

00:03:01.048,00:03:03.617
combining different patterns of
spikes to create some

00:03:03.617,00:03:06.353
biologically represent
biological representation of of

00:03:06.353,00:03:11.758
a memory um combining text to
try to uh u u using

00:03:11.758,00:03:14.327
[indiscernible] and similar
techniques to try to generate

00:03:14.327,00:03:18.598
text. Um this is this is not
necessarily anything new. Uh the

00:03:18.598,00:03:21.134
field is known as natural
language processing. It's been

00:03:21.134,00:03:24.104
around for a really long time.
One of the kind of uh

00:03:24.104,00:03:28.141
fundamental examples happened
over 50 years ago with the Eliza

00:03:28.141,00:03:32.179
chat box. So this was a this was
designed by psycho therapist

00:03:32.179,00:03:36.149
named Joseph Wiezenbaum. MIT.
And he used it in a very

00:03:36.149,00:03:40.153
clinical setting. So he wanted
to try to have his patients who

00:03:40.153,00:03:43.090
were either on their death bed
or close to death um be able to

00:03:43.090,00:03:46.693
interact in some way with a with
a computer. So it was very kind

00:03:46.693,00:03:50.564
of naive very ad hoc um it was
based on parsing the keyword

00:03:50.564,00:03:53.800
replacement. It would it would
simply do something like give

00:03:53.800,00:03:57.604
the input to the program was my
head hurts. Uh it would output

00:03:57.604,00:04:00.474
something in response like why
do you say your head hurts? Or

00:04:00.474,00:04:03.477
how bad does your head hurt? So
something like this. Uh and

00:04:03.477,00:04:07.013
these kind of very early
examples were uh inspiring for

00:04:07.013,00:04:10.750
people uh because they they
passed some very simple versions

00:04:10.750,00:04:13.954
of the Turin test right? So um
using these kinds of questions

00:04:13.954,00:04:16.923
and this very ad hoc feedback
goes was able to uh um not

00:04:16.923,00:04:20.293
really or or fool people into
believing that they might be

00:04:20.293,00:04:24.498
talking to a human rather than a
machine. Fast forward 50 years

00:04:24.498,00:04:28.502
and we have Microsoft AI which
came out with a neuro-network

00:04:28.502,00:04:32.639
that was based uh or it was
called Tay Tay and You. Um and

00:04:32.639,00:04:35.775
so if you've seen this in the re
in the news recently it was kind

00:04:35.775,00:04:39.746
of a dynamically learning bot
that was released on Twitter. Uh

00:04:39.746,00:04:43.250
and it was a really cool idea.
So each time a user a Twitter

00:04:43.250,00:04:46.920
user tweeted at it it would kind
of learn from that tweet. Uh and

00:04:46.920,00:04:49.356
then reply to it. It was a chat
bot. And you see this a lot

00:04:49.356,00:04:52.526
popping up now in Facebook and
other kind of social media

00:04:52.526,00:04:56.730
services uh for more of like a
marketing twist. But uh what

00:04:56.730,00:04:59.966
they didn't foresee was the fact
that Twitter tends to be a

00:04:59.966,00:05:03.236
cesspool sometimes. And tends to
be filled with porn and sexually

00:05:03.236,00:05:08.108
explicit content and overall
kind of [laugh] bad stuff. So uh

00:05:08.108,00:05:10.577
what it actually turned in to
was a porn written race uh

00:05:10.577,00:05:13.446
racists nazi bot. And it turned
into quite a like a [laughter]

00:05:13.446,00:05:19.219
PR disaster for Microsoft. And
they had to shut it down. Um so

00:05:19.219,00:05:23.890
indeed we view info second
machine learning um as kind of

00:05:23.890,00:05:28.495
prioritizing the defensive
orientation right? So um you

00:05:28.495,00:05:32.566
setup perimeter or you try to
detect incoming threats um or

00:05:32.566,00:05:34.401
you try to remediate it once
it's already happened. The

00:05:34.401,00:05:38.338
adversary has to do something in
order for you to react to it.

00:05:38.338,00:05:41.841
And defend your network or
whatever it may be. Um so you

00:05:41.841,00:05:44.110
have some examples here. These
are historical Black Hat talks

00:05:44.110,00:05:47.180
over the last 10 or 15 years .
Um you have some machine

00:05:47.180,00:05:51.017
learning talks. One or two per
year usually. Um and they cover

00:05:51.017,00:05:54.955
anything from spam filtering to
bot net identification to

00:05:54.955,00:05:58.491
network defense to intrusion
detection. Um but what we wanted

00:05:58.491,00:06:01.194
to [indiscernible] to propose
here was rather that you could

00:06:01.194,00:06:04.097
use artificial intelligence
techniques um and machine

00:06:04.097,00:06:07.534
learning not only on defense but
you can use data to drive an

00:06:07.534,00:06:11.972
offensive capability. Uh we call
our tool Snapper. Um it's the

00:06:11.972,00:06:14.507
Social Network Automated
Phishing and Reconnaissance

00:06:14.507,00:06:19.179
tool. And it's split up into 2
separate phases. The first phase

00:06:19.179,00:06:24.851
takes as input a set of users
who you want to target. Um and

00:06:24.851,00:06:28.088
it takes this set of users and
extracts a subset of them that

00:06:28.088,00:06:31.224
it deems as high value targets.
So it prioritizes them. We'll

00:06:31.224,00:06:34.027
get in to more about this later.
Uh and then the second phase of

00:06:34.027,00:06:38.965
the tool takes those users and
crafts a Tweet uh directed at

00:06:38.965,00:06:41.234
them based on the content that
they have on their historical

00:06:41.234,00:06:46.172
Twitter timeline. Um and the end
result of this is a Tweet with

00:06:46.172,00:06:50.110
an at mention and the crafted um
machine generated text and then

00:06:50.110,00:06:53.280
a shortened link which we
measure uh success using click

00:06:53.280,00:06:58.285
through rates. Um so with that
if uh if anyone wants to partake

00:07:00.353,00:07:03.156
in the demo we're going to do
later on in the talk please

00:07:03.156,00:07:06.926
tweet at the hash tag snapper.
And that's hash tag s n a p

00:07:06.926,00:07:09.829
underscore r. Um we're not going
to target you with any kind of

00:07:09.829,00:07:11.865
malicious payload. It'll be a
shortened link that just

00:07:11.865,00:07:14.768
redirects to Google dot commers
and like that. Um but if you

00:07:14.768,00:07:17.771
want to have your timeline read
dynamically and then have a

00:07:17.771,00:07:21.274
tweet spit back out at you uh
please do that in the next 20 or

00:07:21.274,00:07:25.779
25 minutes. Uh so the talk will
go I'll I'll hand it off to John

00:07:25.779,00:07:27.480
to talk about machine learning
and offense and then we'll go

00:07:27.480,00:07:30.083
into the 2 parts of the tool
target discovery and spear

00:07:30.083,00:07:33.053
phishing and talk in more detail
about how to generate the

00:07:33.053,00:07:35.889
message content. That's kind of
the core of the tool. And then

00:07:35.889,00:07:39.025
we'll talk about how we evalue
the tool and that evaluation

00:07:39.025,00:07:41.828
compares to other techniques uh
that have been found in the

00:07:41.828,00:07:47.267
literature. [pause - mic sounds]
>> Alright cool. Um so the first

00:07:47.267,00:07:50.670
question is like so why is
social media such a great place

00:07:50.670,00:07:52.939
for spear phishing people?
Right? Why Twitter in

00:07:52.939,00:07:55.542
particular? Um there's a lot of
answers to this and we put a few

00:07:55.542,00:07:59.245
on this slide. Uh first thing it
a lot of these social networks

00:07:59.245,00:08:03.083
have very bot friendly APIs.
Right? Um whenever you post

00:08:03.083,00:08:08.955
something on Twitter um then uh
um people can go and scrape your

00:08:08.955,00:08:12.425
timeline your activity records
things like that very easily.

00:08:12.425,00:08:16.496
Because they are python uh APIs
for all the social networks just

00:08:16.496,00:08:19.566
straight up available. Another
thing is there's a very

00:08:19.566,00:08:23.570
colloquial syntax on Twitter and
social networks. Um for example

00:08:23.570,00:08:26.339
uh when when [indiscernible]
actually posted this tweet I

00:08:26.339,00:08:29.008
really quick snapped her and
said hey can we use this for our

00:08:29.008,00:08:31.711
talk? Uh 20 years ago you
wouldn't have any idea what this

00:08:31.711,00:08:38.084
meant. Um so the idea here is
like basically machine lea

00:08:38.084,00:08:40.787
learning tools especially
generative models tend to be

00:08:40.787,00:08:43.089
pretty bad. If you've ever seen
like [indiscernible] simulator

00:08:43.089,00:08:47.060
and things like that. Um but the
fact is that the bar on Twitter

00:08:47.060,00:08:50.663
is so low to have a good you
know tweet uh that people will

00:08:50.663,00:08:55.101
be interested in. Um even even
generative models can do pretty

00:08:55.101,00:08:59.472
freaking well. Um some other
things are like due to character

00:08:59.472,00:09:02.142
limits. Uh there are a lot of
shortened links on Twitter. I

00:09:02.142,00:09:06.079
don't know if you've ever used
it. Um so basically if you're

00:09:06.079,00:09:08.248
trying to obfuscate a payload or
something like that um people

00:09:08.248,00:09:09.616
don't actually think twice about
clicking links on Twitter. You

00:09:09.616,00:09:10.950
know that are that are
shortened. Right? Because

00:09:10.950,00:09:12.285
everything's actually shortened
there. Um then there's also the

00:09:12.285,00:09:14.020
fact that like people sort of
seem to understand even now or

00:09:14.020,00:09:18.591
at least some people do at this
point. Um like Nigerian prince

00:09:18.591,00:09:24.697
scams. You know things like
that. Uh a lot of people

00:09:24.697,00:09:29.702
actually like can tell you hey
you know you get an email check

00:09:31.905,00:09:36.776
the link before you click. Um on
Twitter and social media you

00:09:36.776,00:09:39.345
know social networks people
don't actually think about what

00:09:39.345,00:09:42.248
they click on. You know it's
it's you don't have that sort of

00:09:42.248,00:09:45.185
years of awareness built up yet.
And that's one of the things

00:09:45.185,00:09:49.089
we're trying to actually bring
about with this talk. And then

00:09:49.089,00:09:53.159
finally um people actually want
to share content on these social

00:09:53.159,00:09:56.996
media you know networks. Right?
Um for example Reddit like you

00:09:56.996,00:09:59.933
want to get up votes. Twitter
you want people to share and

00:09:59.933,00:10:03.236
like your content. Right? So
there's sort of this idea of

00:10:03.236,00:10:06.840
like incentivizing data
disclosure. Um if you're you

00:10:06.840,00:10:09.576
know um on Twitter you're
sharing a lot of personal

00:10:09.576,00:10:12.345
information about yourself about
things that you like things that

00:10:12.345,00:10:17.050
you enjoy that can all be used
against you. So we wanted to

00:10:17.050,00:10:19.819
give a quick shout out actually
um at SchmooCon there's a really

00:10:19.819,00:10:22.956
really cool talk about uh you
know phishing the phishers using

00:10:22.956,00:10:25.892
mark off trains. And that was
actually a huge inspiration for

00:10:25.892,00:10:29.762
this talk. So we just wanted to
give a quick shout out. But

00:10:29.762,00:10:33.566
getting right in to the tool
itself um basically there's some

00:10:33.566,00:10:36.135
things built in to the tool
directly. And there's some

00:10:36.135,00:10:39.606
things that we also add on top
of the tool. Right? So things

00:10:39.606,00:10:42.809
that the tool does directly are
it pre-pens tweets with an app

00:10:42.809,00:10:46.713
mention. And on Twitter this
actually changes what the tweets

00:10:46.713,00:10:50.950
are categorized in their uh in
their process. Right? Um tweets

00:10:50.950,00:10:54.687
that start with an app mention
are called replies. And only

00:10:54.687,00:10:57.991
people who follow both the
person tweeting and the target

00:10:57.991,00:11:00.994
can actually see those tweets.
So if our bot doesn't have any

00:11:00.994,00:11:03.696
followers that means the only
person who can see the tweet is

00:11:03.696,00:11:07.133
the target self. Which actually
is is very useful in determining

00:11:07.133,00:11:11.304
whether or not an individual you
know target has clicked. Um

00:11:11.304,00:11:14.674
another thing that's actually
built into the tool is it

00:11:14.674,00:11:18.177
shortens the payload uniquely
per user. And we'll get into

00:11:18.177,00:11:21.614
that in a bit. Um so that way we
can actually go through and each

00:11:21.614,00:11:23.716
of our shortened links that we
generate we can check whether or

00:11:23.716,00:11:26.519
not that particular link was
clicked and map that back to the

00:11:26.519,00:11:31.558
user who clicked it. Also uh we
triage users with respect to

00:11:31.558,00:11:34.327
value and engagement. So we have
a machine learning model that

00:11:34.327,00:11:38.231
we'll talk about in a bit. That
actually goes first before it

00:11:38.231,00:11:41.501
actually phishes the person uh
checks to see whether or not

00:11:41.501,00:11:44.337
they're a valuable target.
Whether they interact a lot with

00:11:44.337,00:11:48.041
the platform for example. Um a
one reason this is useful is for

00:11:48.041,00:11:51.444
example a lot of people have
whats know as egg profiles or

00:11:51.444,00:11:53.846
profiles where they haven't
changed the default settings.

00:11:53.846,00:11:56.549
These people tend not to post a
lot. They don't they're not very

00:11:56.549,00:12:00.787
engaged. And we don't want to uh
waste API requests or you know

00:12:00.787,00:12:04.958
waste like possible um awareness
of the bot. Right? By trying to

00:12:04.958,00:12:08.061
phish these people. Um so we
just go ahead and actually

00:12:08.061,00:12:10.964
triage these users out so that
we don't have to worry about

00:12:10.964,00:12:15.201
them. And then finally the tool
itself obeys rate limits. Um

00:12:15.201,00:12:17.470
this is because we sort of
wanted to release it as an

00:12:17.470,00:12:21.874
internal pen testing tool. Um
obviously you know people can

00:12:21.874,00:12:25.411
get around that but we hope you
know you guys don't. Um that's

00:12:25.411,00:12:28.815
all I'll say about that. Um some
things that aren't actually

00:12:28.815,00:12:31.818
built into the tool that are
very very useful. Um first off

00:12:31.818,00:12:36.022
um Twitter's actually pretty
good if you post every single

00:12:36.022,00:12:39.559
post of yours has a link in it.
Um they're good at finding that

00:12:39.559,00:12:42.962
and shutting you down. So one of
the things we recommend is post

00:12:42.962,00:12:45.598
a couple you know non phishing
posts in there or get ready to

00:12:45.598,00:12:49.535
make a lot of accounts. And then
another thing is um if you

00:12:49.535,00:12:53.239
yourself the bot have an egg
profile you know um nobody's

00:12:53.239,00:12:57.110
going to actually click on your
links because obviously um they

00:12:57.110,00:12:59.245
they like to see believable
profiles before they click

00:12:59.245,00:13:05.418
links. So a very high level of
uh design flow of the tool. Um

00:13:05.418,00:13:07.620
first we have a list of Twitter
users that we pass into the

00:13:07.620,00:13:11.224
tool. It goes through each user
and asks whether they're a valid

00:13:11.224,00:13:14.927
you know whether they're a high
value high uh um engagement user

00:13:14.927,00:13:19.265
or not. And if they are it
scrapes their timeline to a

00:13:19.265,00:13:23.736
specified depth. Um so for
example 200 or 400 tweets that

00:13:23.736,00:13:26.572
they've sent. And uses that to
either seed um [indiscernible]

00:13:26.572,00:13:31.778
model or a euro-network model.
And that generates the actual

00:13:31.778,00:13:37.116
text of the post. After it's
generated the text then it you

00:13:37.116,00:13:39.852
can either have it schedule the
tweet for a later time when

00:13:39.852,00:13:43.222
they're most engaged and it
actually uh calculates all that

00:13:43.222,00:13:46.726
for you. Or you can post the
tweet immediately and have the

00:13:46.726,00:13:50.329
uh the tool sweep to obey rate
limits. And that's actually

00:13:50.329,00:13:55.334
useful if you're doing an
onstage demo. That yeah. >> Cool

00:13:57.804,00:14:02.008
so lets get into the tool. I'll
talk about the first phase here

00:14:02.008,00:14:05.078
automated target discovery. So
this is what Twitter looks like

00:14:05.078,00:14:09.182
if anyone's been living under a
rock for the last 10 years. Um

00:14:09.182,00:14:11.951
Twitter is full of interesting
information and personal

00:14:11.951,00:14:14.987
information like John said. You
have this incentivization

00:14:14.987,00:14:18.024
structure for disclosing
personal data. Um and by that I

00:14:18.024,00:14:22.195
mean it's not necessarily just
the content of the posts. So the

00:14:22.195,00:14:25.131
last tweets that were made you
also have super value

00:14:25.131,00:14:26.899
[indiscernible] information
present in the description.

00:14:26.899,00:14:30.403
People on Twitter tend to like
to post about what their job

00:14:30.403,00:14:33.906
title is and what their
interests are generally. Um you

00:14:33.906,00:14:37.477
ha you get different kind of
data not just text. You have um

00:14:37.477,00:14:39.979
integers like how many followers
and how how many followers you

00:14:39.979,00:14:42.415
have. How many people are
following you. How many lists

00:14:42.415,00:14:47.053
you belong to. Um you have a lot
of kind of boolean fields like

00:14:47.053,00:14:50.223
have you changed your background
profile image? Have you changed

00:14:50.223,00:14:52.892
any of your other default
settings uh from the original

00:14:52.892,00:14:56.629
instant [indiscernible] of your
registration? Um it's filled

00:14:56.629,00:15:00.299
with different dates like your
created at date and URLs within

00:15:00.299,00:15:04.570
the text that you post. So this
is what the the raw API call

00:15:04.570,00:15:07.740
call looks like from Twitter
when you when you grab uh when

00:15:07.740,00:15:11.010
you grab it. So I'll I'll use
the example for for this section

00:15:11.010,00:15:17.083
of Eric Schmidt. The former CEO
of Google. Um so we we implement

00:15:17.083,00:15:20.186
a cluster algorithm so it's
based on machine learning we go

00:15:20.186,00:15:23.489
out we grab a bunch of Twitter
users and we extract features

00:15:23.489,00:15:26.793
from these uh from these API
calls. Across these different

00:15:26.793,00:15:30.863
users. Uh and here I list a few
of the most most interesting and

00:15:30.863,00:15:33.833
most relevant features that we
grab. So like I said in in the

00:15:33.833,00:15:37.503
description if you have words
that tend to correspond to a job

00:15:37.503,00:15:43.109
title like CEO CSO CISO uh even
like recruiter or you know

00:15:43.109,00:15:46.045
engineer or something like this.
This is probably going to end up

00:15:46.045,00:15:49.048
being someone that you might
want to target. Right? Um they

00:15:49.048,00:15:51.217
might have access to some
sensitive information company

00:15:51.217,00:15:53.252
information or whatever. If you
belong to some other

00:15:53.252,00:15:56.923
organization. Um also your level
engagement. So how many people

00:15:56.923,00:16:00.026
are following following you and
how many you're following. Um

00:16:00.026,00:16:02.361
you can imagine you don't want
to you don't want to target

00:16:02.361,00:16:04.997
somebody who's not very active
on the platform. Uh you wanna

00:16:04.997,00:16:08.601
make sure that someone who is
actively engaged and is likely

00:16:08.601,00:16:12.271
to click on links and is getting
updates on their phone. Um the

00:16:12.271,00:16:15.308
account age is a good piece of
information too. Uh the created

00:16:15.308,00:16:18.244
at date of the Twitter profile.
You might want to target you

00:16:18.244,00:16:21.347
don't really want to target
somebody who's just made the

00:16:21.347,00:16:23.015
account and is just trying to
get started up with the

00:16:23.015,00:16:25.952
platform. Um same thing for hash
tag my first tweet. And then

00:16:25.952,00:16:29.956
also a good indicator is uh the
default settings. So it um

00:16:29.956,00:16:33.059
people who tend to engage a lot
in the platform um will will

00:16:33.059,00:16:36.262
kind of make it fancy. They'll
change all the default settings

00:16:36.262,00:16:39.198
and they'll make it um more
matching to what they're

00:16:39.198,00:16:42.401
interests are and what they
like. Um so in a nutshell this

00:16:42.401,00:16:45.771
is how it works. If we take the
clustering algorithm uh and we

00:16:45.771,00:16:50.610
start out with our our target
Eric Schmidt. Um you can imagine

00:16:50.610,00:16:55.248
now that each Twitter user is
represented on this 2-D plot as

00:16:55.248,00:16:58.751
a single point. Um again it's
I'm projecting it in 2

00:16:58.751,00:17:01.254
dimensions. Originally it was a
very very high feature high

00:17:01.254,00:17:03.923
dimensional feature space. With
all those different settings

00:17:03.923,00:17:08.628
like the description uh number
of followers etc. Projected into

00:17:08.628,00:17:12.231
2-D and Eric Schmidt falls on
this 2-D plot somewhere there.

00:17:12.231,00:17:15.134
Uh great. What do we do with
that? We pass it through the

00:17:15.134,00:17:18.037
clustering algorithm that we
have. Um and I'll talk in in the

00:17:18.037,00:17:21.274
next slide about how we choose
that. Um but once once you do

00:17:21.274,00:17:24.076
something like that then you
actually get to extract a subset

00:17:24.076,00:17:26.913
of these users that you might
deem uh as a relevant target or

00:17:26.913,00:17:29.682
a high value target. So up in
the left hand corner of the plot

00:17:29.682,00:17:32.818
of red red points there might be
a group of people that you deem

00:17:32.818,00:17:35.821
as high value targets. And the
the users who belong in the blue

00:17:35.821,00:17:38.491
and the green points you wanna
throw them aside. De-prioritize

00:17:38.491,00:17:44.564
them. Um so in the machine
learning world uh there are many

00:17:44.564,00:17:47.333
different clustering algorithms
so you can choose from. Uh and

00:17:47.333,00:17:50.636
each of those algorithms have a
certain set of hyper parameters

00:17:50.636,00:17:53.806
that you can tune to kind of
optimize your technique and

00:17:53.806,00:17:57.710
optimize your clusters. Uh how
do we chose this? We throw a

00:17:57.710,00:18:02.148
bunch of clustering algorithms
uh into into kind of like a grid

00:18:02.148,00:18:05.484
search more or less. Right? So
we have Cayman's and a parameter

00:18:05.484,00:18:07.286
for Cayman's clustering
algorithm is the number of

00:18:07.286,00:18:12.325
clusters that you choose
[indiscernible]. Um for example.

00:18:12.325,00:18:16.062
And you take those and you fit
the models for each of these

00:18:16.062,00:18:19.465
different set of algorithms and
their set of hyper-parameters.

00:18:19.465,00:18:22.001
And you choose the one that
maximizes the silhouette score.

00:18:22.001,00:18:26.138
Um so the silhouette score is
bound behove between negative 1

00:18:26.138,00:18:29.642
and 1. Uh and anywhere fr a
positive number the more

00:18:29.642,00:18:32.345
positive the better. And
anywhere from kind of point 5 to

00:18:32.345,00:18:35.214
point 7 and up is is considered
some kind of reasonable

00:18:35.214,00:18:38.718
structure. Silhouette score kind
of measures how similar that

00:18:38.718,00:18:42.221
data point is to it's own
cluster. So the cohesion within

00:18:42.221,00:18:46.759
that cluster to uh to how how it
compares with data points

00:18:46.759,00:18:49.395
outside that cluster. The
separation of those. Of those

00:18:49.395,00:18:52.798
data points. So on this plot
each individual data points of

00:18:52.798,00:18:55.568
each individual Twitter users is
represented kind of as a as a

00:18:55.568,00:18:59.105
horizontal bar. And the
hyper-parameters are on the

00:18:59.105,00:19:03.909
y-axis. So if you look at the
first the top top there. Um you

00:19:03.909,00:19:06.345
have 2 different sets of
hyper-parameters for

00:19:06.345,00:19:07.947
[indiscernible]. One might have
2 clusters one might have 3

00:19:07.947,00:19:11.550
clusters. Uh so you've you
[indiscernible] silhouette score

00:19:11.550,00:19:14.620
for each individual data point.
And you calculate the average of

00:19:14.620,00:19:18.057
that which is to which is shown
here by that red dotted line.

00:19:18.057,00:19:20.760
And basically you want to choose
the algorithm that pushes that

00:19:20.760,00:19:22.995
red dotted line all the way as
far right as you possibly can

00:19:22.995,00:19:28.000
get it to. Um right. [pause]
right [pause] >> All right cool.

00:19:33.172,00:19:35.608
So uh before we actually get
into the cool machine learning

00:19:35.608,00:19:37.877
models and stuff for generating
text. We're gonna tease you guys

00:19:37.877,00:19:40.346
a bit with some of the boiler
plate that goes around the

00:19:40.346,00:19:43.649
tweets. Um so one of the first
things that we actually ran into

00:19:43.649,00:19:47.586
was we wanted to choose a url
shortener right? And uh we want

00:19:47.586,00:19:50.189
the url shortener with a lot of
different qualities. One of them

00:19:50.189,00:19:53.793
being you know can actually can
shorten malicious links. And so

00:19:53.793,00:19:56.395
the first thing is we went out
we found a malicious link we

00:19:56.395,00:19:59.498
verified using virus total that
it is indeed malicious. And we

00:19:59.498,00:20:03.002
actually went to it too in a
sandbox and all that. And we

00:20:03.002,00:20:05.638
tried it through a lot of
different link na shorteners and

00:20:05.638,00:20:08.808
apparently google gl let's us
shorten it. Right? And so

00:20:08.808,00:20:12.278
actually several others also let
us shorten it. But goo dot gl

00:20:12.278,00:20:15.981
gives us a lot of cool other
things. Um first off it it gives

00:20:15.981,00:20:18.317
us sort of like a timeline of
when people click. And

00:20:18.317,00:20:21.587
apparently this link is already
been shortened before and people

00:20:21.587,00:20:26.025
of clicked it. Um that's you
know a tale for another time. Um

00:20:26.025,00:20:28.894
goo dot gl also gives us a lot
of cool analytics like who

00:20:28.894,00:20:32.998
referred the link? For example t
dot ceo. Um what browser did the

00:20:32.998,00:20:37.136
target use? What country were
they based in? Or at least you

00:20:37.136,00:20:41.741
know did there uh um like actual
machine say they were? And uh

00:20:41.741,00:20:45.244
what platform they so Windows
Chrome you know those sorts of

00:20:45.244,00:20:52.151
things. Uh Android um and all
that. Um so yeah. So goo dot gl

00:20:52.151,00:20:54.220
actually looks pretty
legitimate. I ran it by a few

00:20:54.220,00:20:56.856
guys in there and they were like
hey yeah like it comes from

00:20:56.856,00:21:00.493
Google it's gotta be safe.
Right? And no. Um it can link to

00:21:00.493,00:21:04.029
malicious sites. So we verified
that. Um it also gives us really

00:21:04.029,00:21:06.799
cool analytics which is very
useful if you're you know trying

00:21:06.799,00:21:09.602
to spear phish internally right?
You want to know which users

00:21:09.602,00:21:13.405
clicked. Um but some other cools
things that it gives us is it

00:21:13.405,00:21:15.875
you're able to actually create
shortened links on the fly using

00:21:15.875,00:21:19.411
their APIs. So you can actually
say hey here's this you know

00:21:19.411,00:21:22.848
general payload www dot google
dot com. Let's shorten it

00:21:22.848,00:21:26.152
uniquely for each individual
user. And see you know which end

00:21:26.152,00:21:29.321
of those real users actually
click on the link. And then you

00:21:29.321,00:21:32.758
can also obtain all of these
analytics programmatically. So

00:21:32.758,00:21:36.495
there's really like no manual
you know uh uh process that you

00:21:36.495,00:21:40.533
need at all um in this this
entire process. And uh we'll

00:21:40.533,00:21:44.537
we'll go ahead and give the the
note that we never actually

00:21:44.537,00:21:48.674
posted any malicious links to
any targets. We just verified

00:21:48.674,00:21:52.711
that you can actually shorten
malicious links in here. Um so

00:21:52.711,00:21:57.116
please don't get mad at us about
that. And then finally another

00:21:57.116,00:22:00.386
thing that the tool does uh in
the box is it does some basic

00:22:00.386,00:22:04.857
recon and profiling. Um so 2
things that it does is it

00:22:04.857,00:22:09.094
figures out what time the user
is uh likely to engage the

00:22:09.094,00:22:12.064
platform. And it um looks at
what topics that they're

00:22:12.064,00:22:15.935
interested in and tries to
create uh a tweet based on one

00:22:15.935,00:22:20.239
of those topics. So for actually
figuring out the scheduling the

00:22:20.239,00:22:23.809
post the what time the user is
active we just use a simple

00:22:23.809,00:22:28.280
histogram for tweet times what
uh which hours that that user

00:22:28.280,00:22:31.817
tweets. And over on the left
you'll actually see my own uh

00:22:31.817,00:22:35.921
tweet history uh timings um so
you can actually see that I'm

00:22:35.921,00:22:40.459
most active at 11 pm at night.
Take that what you will. Um but

00:22:40.459,00:22:45.998
it's it's actually very easy to
find this data. Right? And uh

00:22:45.998,00:22:49.101
for topics we actually started
like when we first started this

00:22:49.101,00:22:51.637
project we were thinking really
really complicated like you know

00:22:51.637,00:22:55.474
super lda and all the things and
what not. Um but we found

00:22:55.474,00:22:58.544
actually pretty early on was
just a simple bag of words and

00:22:58.544,00:23:01.480
counting frequency does really
well for finding topics as long

00:23:01.480,00:23:04.850
as you remove all of the stop
words. Um so with these 2 things

00:23:04.850,00:23:08.354
we can actually see the models
and sweep you know the tool to

00:23:08.354,00:23:11.991
uh tweet at a time when the user
is likely to respond. And also

00:23:11.991,00:23:14.727
tweet on something that they're
likely to be engaged with.

00:23:20.366,00:23:24.670
[pause] >> Great so so at this
point now we've taken a bunch of

00:23:24.670,00:23:27.439
input users and extracted a
subset of them that we want to

00:23:27.439,00:23:30.509
target. Uh and we calculated
what they like to talk about.

00:23:30.509,00:23:33.679
The topic. And we've also
determined that at which time

00:23:33.679,00:23:36.115
are they're most active with
with Twitter or with the Twitter

00:23:36.115,00:23:40.152
platform. So now how do we go
about getting um getting them a

00:23:40.152,00:23:43.289
tweet that they might be more
likely to click on than your

00:23:43.289,00:23:47.826
your normal uh any random
question. So we do we do this in

00:23:47.826,00:23:50.729
2 separate ways. And the first
way is we leverage markup

00:23:50.729,00:23:53.599
models. Um so markup models
they're populated for text

00:23:53.599,00:23:57.002
generation like John said the
subset simulator or in the info

00:23:57.002,00:24:01.941
[indiscernible] talk title bot.
But how it works is um using

00:24:01.941,00:24:06.412
Twitter API you can go and grab
the last x post on someone's

00:24:06.412,00:24:10.649
timeline right? 200 500 1000 um
however many you want to grab.

00:24:10.649,00:24:13.819
And we call this the corpus. So
you take your corpus and you

00:24:13.819,00:24:18.691
want to learn um pair of y
frequencies of um of likeliness

00:24:18.691,00:24:22.294
between these words. Right? So
uh for example you might you

00:24:22.294,00:24:25.030
might have the word I that
occurs a lot within this corpus.

00:24:25.030,00:24:27.566
Sometimes it might be followed
by the word don't. Other times

00:24:27.566,00:24:31.403
it might be followed by the word
like. So based on the relative

00:24:31.403,00:24:33.972
co-occurance of these words in
your corpus you can then

00:24:33.972,00:24:38.077
generate a model that
probabilistically determines um

00:24:38.077,00:24:41.313
how likely it is to create kind
of this string of sentences. I

00:24:41.313,00:24:44.149
like or I don't. And you can
continue this uh for the length

00:24:44.149,00:24:47.086
of the entire tweet. So it's
based on purely transition

00:24:47.086,00:24:52.624
probabilities from one word to
the next. Um on the other hand

00:24:52.624,00:24:55.828
we trained the recurrent
euro-network. Um and this is

00:24:55.828,00:24:59.431
called LSTM. And LSTM is an
acronym for Long Short Term

00:24:59.431,00:25:02.534
Memory. And so this is a bit
more cumbersome. It's less

00:25:02.534,00:25:06.505
flexible than the markup model.
Um we took five and a half days

00:25:06.505,00:25:11.677
to to train this neuro-net. Um
we had to do it on an EC2

00:25:11.677,00:25:15.347
instance using a GPU cluster.
And the training set was

00:25:15.347,00:25:18.584
comprised of approximately 2
million tweets. We didn't go out

00:25:18.584,00:25:22.788
and just grab um your run of the
mill any 2 million tweets. Um

00:25:22.788,00:25:25.157
because like I said Twitter
[laugh] Twitter is a veritable

00:25:25.157,00:25:29.128
cess pool. So we had to go and
find kind of legitimate looking

00:25:29.128,00:25:33.999
tweets. Uh to do that uh Twitter
has an account called at um at

00:25:33.999,00:25:38.137
verified. And that account in
turn follows all the verified

00:25:38.137,00:25:40.205
accounts on Twitter. All the
ones with that blue check mark

00:25:40.205,00:25:44.109
next to it. And so our idea was
that this the people that are uh

00:25:44.109,00:25:47.379
that are verified accounts are
probably more legitimate.

00:25:47.379,00:25:49.248
They're probably posting about
some kind of relevant

00:25:49.248,00:25:51.750
information. And so we trained
it on this huge corpus of

00:25:51.750,00:25:54.987
tweets. The network properties
we used 3 layers of this

00:25:54.987,00:25:57.289
euro-network and approximately 5
legit layers per [indiscernible]

00:25:57.289,00:26:01.960
uh units per layer. Sorry. And
the idea here is that

00:26:01.960,00:26:05.164
neuro-networks are or at least
this neuro-network in in

00:26:05.164,00:26:09.301
particular is is much better at
learning long term dependencies

00:26:09.301,00:26:12.438
between words in a sentence. So
LSTMs are often deployed when

00:26:12.438,00:26:16.141
people want to learn uh
sequences of data. Un and in

00:26:16.141,00:26:19.411
this context you can imagine a
tweet or a sentences being a

00:26:19.411,00:26:24.383
sequence of words. Right? So as
the in in contract to the markup

00:26:24.383,00:26:27.219
model which just care about the
[indiscernible] frequency. The

00:26:27.219,00:26:30.055
word that follows this word. The
recurrent neuro-network on the

00:26:30.055,00:26:33.258
other hand considers long longer
term dependencies. Because what

00:26:33.258,00:26:35.961
I talk about at the beginning of
my sentence might also relate to

00:26:35.961,00:26:39.832
something that comes later on.
Uh this is common in all all

00:26:39.832,00:26:42.768
languages and English uh and
most common in German actually.

00:26:42.768,00:26:45.471
You have these long term
dependencies. You might not know

00:26:45.471,00:26:47.606
what the context of the sentence
is until someone finally

00:26:47.606,00:26:52.010
finishes the word at the end of
it. Um so what were the

00:26:52.010,00:26:54.513
differences between these 2
approaches? The LSTM as I

00:26:54.513,00:26:57.416
mentioned took a few a days to
train. Uh so it's a bit less

00:26:57.416,00:27:00.419
flexible. Far as the markup
chain uh markup chain you can

00:27:00.419,00:27:03.422
deploy it uh and it can learn
with within a matter matter of

00:27:03.422,00:27:06.425
milliseconds. And that kind of
scales depending on how many

00:27:06.425,00:27:09.862
tweets you choose to train it
on. Uh the accuracy for both

00:27:09.862,00:27:12.664
surprisingly was super high. So
even thought the LSTM is a bit

00:27:12.664,00:27:17.202
more generic um and by that I
mean it learns like a kind of a

00:27:17.202,00:27:20.706
deeper representation of what it
means to be a Twitter post. And

00:27:20.706,00:27:24.276
I I caution myself not to call
it English because as John said

00:27:24.276,00:27:27.045
this isn't English this is kind
of twitterese. It's filled with

00:27:27.045,00:27:32.251
hash tags and and different kind
of syntatical auto ease and um

00:27:32.251,00:27:36.889
abbreviations. Uh so the
availability of both of these

00:27:36.889,00:27:42.027
tools uh is public. You can go
out. You can download um a LSTM

00:27:42.027,00:27:45.931
model using different python
libraries or other otherwise

00:27:45.931,00:27:50.102
markup chain as well. Uh and the
size of these LSTM is much much

00:27:50.102,00:27:53.605
largest around dick uh disk
compared to the markup chain. Um

00:27:53.605,00:27:55.707
but like I said the markup chain
tends to over fit on each

00:27:55.707,00:27:59.311
specific user. The idea being
let's say you're posting today

00:27:59.311,00:28:01.813
or in the next week about the
Olympics. Or something like

00:28:01.813,00:28:05.150
that. Maybe 2 months from now if
I go back and I read your

00:28:05.150,00:28:08.720
historical timeline posts and I
I tweet back at you with

00:28:08.720,00:28:11.490
something about the Olympics uh
it might raise your eyebrows

00:28:11.490,00:28:14.026
because the Olympics have been
over for a while and you don't

00:28:14.026,00:28:19.398
really care about them anymore.
Um the cool thing about markup

00:28:19.398,00:28:21.733
models that [indiscernible] is
that you don't need to retrain

00:28:21.733,00:28:24.570
it every time. Like I said it's
very flexible. You can deploy it

00:28:24.570,00:28:28.307
very fast. Um what this means is
that it generalizes out of the

00:28:28.307,00:28:33.011
box to different languages. It's
it's language agnostic. Uh so if

00:28:33.011,00:28:35.981
you're posting on Twitter and
you're you're posting in Spanish

00:28:35.981,00:28:39.451
or even Russian or Chinese
entirely different character

00:28:39.451,00:28:41.920
sets um because it's based on
these [indiscernible]

00:28:41.920,00:28:45.090
probabilities it's gonna
dynamically learn you know what

00:28:45.090,00:28:46.858
word likes to be followed by the
next. And you're then able to

00:28:46.858,00:28:51.263
post a a tweet back at somebody
based on the language they're

00:28:51.263,00:28:55.834
typing in. So here's an example.
Um that's in Spanish. And if

00:28:55.834,00:28:58.837
anyone is from a foreign country
here with a lot of foreign

00:28:58.837,00:29:02.307
language tweets um and while
it's a volunteer for the demo.

00:29:02.307,00:29:06.612
Again please tweet at that hash
tag snapper. Um so we don't like

00:29:06.612,00:29:10.182
to think of this necessarily
also as a Twitter vulnerability

00:29:10.182,00:29:14.086
so to speak. Um this can be
applied to other social networks

00:29:14.086,00:29:18.590
as well. But it all has pretty
accessible APIs. But the idea

00:29:18.590,00:29:22.527
here is that um kind of like
with the rate with the rise of

00:29:22.527,00:29:25.130
AI and the rise of machine
learning and the democratization

00:29:25.130,00:29:28.700
of this as it becomes more and
more possible to do this without

00:29:28.700,00:29:31.570
a PhD for example and the
technology grows and grows and

00:29:31.570,00:29:36.875
becomes more available um th
this is gonna be become more and

00:29:36.875,00:29:43.382
more of a problem. Right? So uh
the the weak point here is is a

00:29:43.382,00:29:48.320
human this is uh classic social
engineering. [pause] >> Cool

00:29:48.320,00:29:51.490
yeah so before we get into the
evaluation results and demo. I

00:29:51.490,00:29:55.227
just wanna say um the tool is
public. So for example there's a

00:29:55.227,00:29:58.997
version on your conference CDs.
And there will also be a get hub

00:29:58.997,00:30:01.533
link that we'll tweet out uh as
soon as we get back home to

00:30:01.533,00:30:06.138
Baltimore. But uh we first uh we
first trained our first couple

00:30:06.138,00:30:08.974
of models and started wild
testing it. And we were

00:30:08.974,00:30:12.511
surprised it did really really
well. Um I don't know if you can

00:30:12.511,00:30:15.681
actually see some of the
pictures but uh for example we

00:30:15.681,00:30:19.251
got uh a guy on the top right um
the first post is what our bot

00:30:19.251,00:30:23.155
posted. And the second is like
the guy responding saying hey

00:30:23.155,00:30:24.656
thanks but the links broken.
Right? Um we actually saw this

00:30:24.656,00:30:25.991
quite a bit. And uh on the
bottom you can see some of the

00:30:25.991,00:30:27.325
example tweets from the first
models that we made. Um so we we

00:30:27.325,00:30:28.694
used these first couple of
models and we did some pilot

00:30:28.694,00:30:33.699
experiments. Um we grabbed 90
users from hash tag cat because

00:30:42.274,00:30:46.378
cats are awesome. And uh we went
ahead and tried to spear phish

00:30:46.378,00:30:50.382
um all these users again with
benign links. And uh we were

00:30:50.382,00:30:54.386
actually surprised at how well
the model did right out of the

00:30:54.386,00:30:58.557
box. Um after 2 hours 17% of
those users had clicked through.

00:30:58.557,00:31:03.595
And after 2 days we had you know
between a 30 and 65 percent um

00:31:03.595,00:31:07.532
66 percent sorry click through
rate. And so why that range is

00:31:07.532,00:31:10.802
so huge actually? Is because
there are a lot of bots crawling

00:31:10.802,00:31:14.906
Twitter clicking on links. Um so
we actually don't know exactly

00:31:14.906,00:31:18.610
how many actual humans click
through. If we use the actual

00:31:18.610,00:31:22.380
strictest definition of what a
human might be so making sure

00:31:22.380,00:31:24.916
that for example [indiscernible]
dot CEO. And the location

00:31:24.916,00:31:27.185
matches up with the location
listed on their profile and

00:31:27.185,00:31:30.055
those sorts of things. That's
where we get that 30% number. Um

00:31:30.055,00:31:34.893
if we if we use a little bit
more relaxed uh criteria for

00:31:34.893,00:31:39.164
judging whether it's a human or
a bot. Um we actually can get up

00:31:39.164,00:31:42.667
to like the number of people
that we think clicked might be

00:31:42.667,00:31:48.173
up to 66%. And so uh actually uh
funny story um with these

00:31:48.173,00:31:51.843
initial models also we saw how
well they did. And um an

00:31:51.843,00:31:54.479
information security
professional who will remain

00:31:54.479,00:31:58.150
unnamed tweeted at us saying hey
proof of concept or get the fuck

00:31:58.150,00:32:02.020
out of here. So we went ahead
and used him as a guinea pig and

00:32:02.020,00:32:04.823
it did actually he did click the
link. So we will say that.

00:32:11.830,00:32:14.065
[laughter] [clapping] Cool. So
uh so then we iterated on the

00:32:14.065,00:32:17.803
model some. And we uh decided we
wanted to test this against a

00:32:17.803,00:32:21.206
human. Right? Um see how well
the human could spear phish or

00:32:21.206,00:32:26.444
phish people. Um versus how well
that the tool could. And uh so

00:32:26.444,00:32:31.216
we had 2 hours. We uh scheduled
on our calendar. And the person

00:32:31.216,00:32:35.921
was able in these 2 hours to
target 129 people. And he did so

00:32:35.921,00:32:38.990
mostly by just copying and
pasting you know pre-made

00:32:38.990,00:32:42.227
messages to these different hash
tags that we talked about

00:32:42.227,00:32:47.532
previously. I think they were
pokeman go info sect um and uh

00:32:47.532,00:32:53.405
something about the DNC. And uh
so we uh he was able to tweet it

00:32:53.405,00:32:57.442
um 129 people in these 2 hours.
Which comes out to be 1 point 0

00:32:57.442,00:33:00.779
7 5 tweets per minute. And he
got a total of 49 click

00:33:00.779,00:33:04.850
throughs. We used 1 instance of
our tool. So 1 instance of

00:33:04.850,00:33:09.654
snapper running. Um and in those
same 2 hours snapper tweeted at

00:33:09.654,00:33:14.492
819 people. Which comes out to 6
point 8 5 tweets per minute. And

00:33:14.492,00:33:18.630
275 of those people clicked
through. And we sort of want to

00:33:18.630,00:33:22.000
emphasize that this is actually
arbitrarily scaleable with the

00:33:22.000,00:33:24.469
number of machines that you
have. The major rate uh the

00:33:24.469,00:33:27.706
major limiting factors are
actually rate limiting and the

00:33:27.706,00:33:32.711
posting mechanism. [pause] So um
sort of a TLDR. Um this tool

00:33:34.713,00:33:38.717
that we've made um they're 2
traditional ways of you know

00:33:38.717,00:33:42.354
creating tweets or or messages
that people will click on. The

00:33:42.354,00:33:45.924
first is you know phishing which
is mostly automated already. And

00:33:45.924,00:33:48.860
has a very very low click
through rate. Um between 5 and

00:33:48.860,00:33:52.097
14 percent. There's also this
other method called spear

00:33:52.097,00:33:54.399
phishing which takes tens of
minutes to do. It's highly

00:33:54.399,00:33:57.469
manual. You have to actually go
out research your target. Find

00:33:57.469,00:33:59.738
out what they enjoy doing. What
time they're interested in

00:33:59.738,00:34:03.475
posting at. Things like that. Um
you get the best spear phishing

00:34:03.475,00:34:06.711
campaigns actually get up to a
45% accuracy from what we've

00:34:06.711,00:34:08.046
seen. And uh we actually kind of
split the difference. We

00:34:08.046,00:34:09.381
actually combine the automated
um um characteristics of

00:34:09.381,00:34:10.749
actually phishing but we still
get pretty close to what the

00:34:10.749,00:34:12.083
actual um effectiveness of spear
phishing. And with that demo

00:34:12.083,00:34:13.418
gods willing we'll do a live
demo of this. [pause] Cool.

00:34:13.418,00:34:14.753
Right? So [pause] I just want to
see so about 151 of you have

00:34:14.753,00:34:16.755
actually tweeted. So this is the
actual command to uh uh run the

00:34:16.755,00:34:21.760
tool. And we're gonna go ahead
and run it. Hopefully. Cool. Um

00:34:26.698,00:34:29.834
I'm actually the first person on
the list. Cause I actually you

00:34:29.834,00:34:32.437
know wanted to make sure that
something worked right. [pause]

00:34:32.437,00:34:35.507
Let's see. So what it's doing is
actually it pulled down the

00:34:35.507,00:34:38.343
users timeline and generated a
tweet for that person. And c'mon

00:34:38.343,00:34:41.212
c'mon. Cool. Actually. Okay so
here it's starting to come out.

00:34:41.212,00:34:44.082
Um so here's that actual post
that it generated. And it uh

00:34:44.082,00:34:49.087
posted you know at my hash tag
the text that it grabbed from my

00:35:10.508,00:35:15.513
profile and the shortened link.
And um so you can see that that

00:35:26.958,00:35:31.997
actually works. And we're not
just saying things. [pause] So

00:35:31.997,00:35:36.401
notice that um on my actual you
know timeline you can't actually

00:35:36.401,00:35:39.537
see that post. Right? And this
is because it's actually called

00:35:39.537,00:35:44.542
a reply. [pause] But hopefully
yep so here's where it actually

00:35:46.845,00:35:49.814
shows up. It shows up in your
notifications. Not your actual

00:35:49.814,00:35:52.417
Tweet history. And so you're the
only one who can actually see

00:35:52.417,00:35:58.556
that. And so uh as you can tell
um yeah. I just got spear

00:35:58.556,00:36:02.527
phished if I click this link. So
it's actually running thorough

00:36:02.527,00:36:05.296
all you guys now who tweeted at
the link and generating text for

00:36:05.296,00:36:08.333
you and posting them. Um so
we'll leave that running as long

00:36:08.333,00:36:10.702
as possible but it'll probably
won't get through all of you

00:36:10.702,00:36:15.707
guys while we uh wrap up the
talk. [pause until 36:22] >>

00:36:22.614,00:36:27.619
Cool. Thank you demo gods. Um
right. And just a few words to

00:36:27.619,00:36:32.490
wrap up. Um why did we do this?
Uh we wanted generally just

00:36:32.490,00:36:36.227
raise awareness and educate
people about the the

00:36:36.227,00:36:41.833
susceptibility and the danger of
social media security. Um like

00:36:41.833,00:36:45.203
John said people usually think
about email uh very cautiously.

00:36:45.203,00:36:48.640
You would never open a link in
an email from somebody that you

00:36:48.640,00:36:51.342
never interacted with before.
And we want to have that same

00:36:51.342,00:36:54.412
culture be instituted on Twitter
now and on other kind of social

00:36:54.412,00:36:58.316
networks. Um another way that
you could use this tool is to if

00:36:58.316,00:37:01.519
you belong to a company um or in
some other kind of organization

00:37:01.519,00:37:04.789
you wanna do some internal pen
testing to see how susceptible

00:37:04.789,00:37:07.792
your employees might be to some
kind of attack like this. This

00:37:07.792,00:37:11.229
could generate good statistics
for you and help you refine your

00:37:11.229,00:37:14.299
kind of educational awareness
programs. Um you could also use

00:37:14.299,00:37:17.068
this for general social
engagement staff recruiting.

00:37:17.068,00:37:19.137
Reading stuff off people's
timelines and then crafting a

00:37:19.137,00:37:21.940
tweet geared at them. Might be a
good way to recruit people or

00:37:21.940,00:37:25.110
even for advertising. The click
through rates here we have are

00:37:25.110,00:37:28.513
are pretty huge compared to your
general uh generic advertising

00:37:28.513,00:37:33.818
campaigns. Um so like I said ML
is becoming more and more

00:37:33.818,00:37:36.688
automated. Data science is
growing. A lot more companies

00:37:36.688,00:37:40.258
are hiring data scientists. And
the tools in the tool box are

00:37:40.258,00:37:43.795
becoming a lot more uh
democratized. You you can you

00:37:43.795,00:37:46.331
can easily go out there's free
software you can use to train

00:37:46.331,00:37:50.869
these models. Um including the
one that we'll release today. So

00:37:50.869,00:37:53.671
the enemy will have this so the
adversary will be able to use

00:37:53.671,00:37:57.275
this to leverage this technology
sooner rather than later. Um one

00:37:57.275,00:38:00.912
way you can try to prevent these
kinds of attacks is to enable

00:38:00.912,00:38:03.348
protect the account on your
Twitter uh on your Twitter

00:38:03.348,00:38:07.118
users. So if you protect your
account you can go out through

00:38:07.118,00:38:10.755
the public APIs and grab your
data. Um there might also be

00:38:10.755,00:38:13.892
ways to detect this stuff using
as I said at the beginning of

00:38:13.892,00:38:17.061
the talk automated methods like
machine learning classifiers or

00:38:17.061,00:38:23.268
whatever have you. Um and also
if you're ever unsure always

00:38:23.268,00:38:27.605
always report a user or report a
poster um if you see a tweet

00:38:27.605,00:38:30.008
like this maybe. Twitter is
pretty good at actually

00:38:30.008,00:38:34.546
responding to these reports. Um
and we we use google dot com as

00:38:34.546,00:38:37.115
our shortened link that that you
redirect to so feel safe to

00:38:37.115,00:38:41.386
click it. Um because if we if we
did something more funny like

00:38:41.386,00:38:43.655
redirect to our Black Hat talk
people might get pissed and try

00:38:43.655,00:38:46.724
to report us. We don't want our
bot to get uh our bot to get

00:38:46.724,00:38:51.930
bend. And so in conclusion ML
can not only only be used in a

00:38:51.930,00:38:55.867
defensive way but you can use it
to automate an attack. Um

00:38:55.867,00:38:58.503
Twitter is especially nice for
this kind of thing because the

00:38:58.503,00:39:01.606
people don't really care if the
message is in perfect English.

00:39:01.606,00:39:04.409
It's slang laden. It's
abbreviation laden. And these

00:39:04.409,00:39:07.412
things actually help the
accuracy of our tool. Uh and

00:39:07.412,00:39:11.015
finally data is out there. It's
publicly available and it can be

00:39:11.015,00:39:14.886
leveraged against someone to
social engineer them. And with

00:39:14.886,00:39:21.859
that we'll take some
questions.[applause] So just

00:39:21.859,00:39:26.864
step up to the uh microphone. If
you have a question. [pause

00:39:35.106,00:39:40.111
until 39:48 - off mic comments -
pause until 40:00] >> Hello ah

00:39:53.691,00:39:58.696
so do you I can hear it >>
Alright if you come >> Yeah >>

00:40:04.969,00:40:08.940
if you just say it we'll repeat
it >> oh >> So have you tried

00:40:08.940,00:40:11.809
implementing anything like
change point detection? For

00:40:11.809,00:40:15.280
cause I know that some research
has been done in using Twitter

00:40:15.280,00:40:18.583
for like thread analysis as
well. It's like trying to

00:40:18.583,00:40:22.754
pinpoint users who say work for
like ISIL or ISIS. And have you

00:40:22.754,00:40:25.590
done any research using like
markoff chains or prior

00:40:25.590,00:40:30.595
distribution detection systems?
>> You wanna take that one? Uh

00:40:32.630,00:40:35.199
[off mic comments] >> Alright so
um we haven't um done any

00:40:35.199,00:40:38.569
research for the purpose of this
talk into that. Um but it's

00:40:38.569,00:40:41.673
definitely a cool thing that
we'd like to look into. So if

00:40:41.673,00:40:44.809
you wanna talk to us a bit more
after the talk about it. We can

00:40:44.809,00:40:49.814
uh get some you know information
and trade some ideas. [pause -

00:40:52.450,00:40:54.385
off mic comments] >> Great
presentation. Uh quick question

00:40:54.385,00:40:57.488
pertaining to the environment of
a mobile platform as this

00:40:57.488,00:41:01.192
applies. Cause I know you guys
touched on mobile. You mentioned

00:41:01.192,00:41:05.430
phone or smart phone per se. Can
you kind of just give me any

00:41:05.430,00:41:10.068
additional thoughts on that
area. >> Um sure so we haven't

00:41:10.068,00:41:12.804
actually uh measure like the
differences between how many

00:41:12.804,00:41:17.108
click on mobile versus how many
click you know from uh a PC or

00:41:17.108,00:41:20.411
something like that. Um but it's
it's something that we can

00:41:20.411,00:41:23.114
definitely do. So if you're
interested in it you know tweet

00:41:23.114,00:41:27.018
at us and we can crunch some
numbers for you. [pause] >> Okay

00:41:27.018,00:41:30.288
you were mentioning that your
neural network uh version of the

00:41:30.288,00:41:34.192
text prediction performed better
than the markoff model in terms

00:41:34.192,00:41:38.596
of like temporal accuracy. Um
what about the neural network

00:41:38.596,00:41:41.632
causes that? Uh over the markoff
model and what would prevent

00:41:41.632,00:41:44.602
that from talking about the
Olympics some month from now?

00:41:44.602,00:41:48.172
And admittedly a new bend on
neural networks? >> Yeah sure.

00:41:48.172,00:41:50.375
Um you know I definitely
recommend looking at some

00:41:50.375,00:41:54.212
documentation about LSTMs. Um
neural networks in principal can

00:41:54.212,00:41:57.582
kind of replicate any any kind
of arbitrary function. This is a

00:41:57.582,00:42:01.386
special kind of neural network
that has different gates in

00:42:01.386,00:42:05.957
between each um each layer of
the LSTM. And these gates kind

00:42:05.957,00:42:10.728
of turn on and off dynamically.
And so it allows you to uh

00:42:10.728,00:42:15.700
remember words at like um a
certain depth back in time. Uh

00:42:15.700,00:42:19.871
and it learns these connections
on the fly. And it's able to

00:42:19.871,00:42:22.673
turn it off and on and because
of that you're able to like lear

00:42:22.673,00:42:25.143
learn longer contextual
information in these words.

00:42:29.347,00:42:32.817
[pause] >> Hey great preso. Uh
just have a question I wanted to

00:42:32.817,00:42:35.286
see what kind of considerations
you had for trying to prevent

00:42:35.286,00:42:38.723
bias in your training set. And
what were some like time biases

00:42:38.723,00:42:41.492
or even just using the approved
Twitter handles might introduce

00:42:41.492,00:42:43.694
some bias in terms of the data
you're looking at. Could you

00:42:43.694,00:42:46.864
discuss some of that? >> Yeah
that's that's definitely some

00:42:46.864,00:42:50.435
valid criticism. So you want to
avoid you know common defaults

00:42:50.435,00:42:53.504
like overfitting to specific
users. Especially in the in the

00:42:53.504,00:42:58.509
clustering thing. Um yep. We we
didn't do any kind of uh formal

00:43:00.745,00:43:04.549
evaluation of the LSTM. We have
a loss that we tried to minimize

00:43:04.549,00:43:09.253
over time. Um but in terms of
the markoff model we just kind

00:43:09.253,00:43:12.256
of tuned it until it looked good
enough and then and then worked

00:43:12.256,00:43:15.393
in in terms of like you know we
we had several different tests

00:43:15.393,00:43:17.695
in the wild. And as soon as we
started getting pretty high

00:43:17.695,00:43:19.497
click through rates we got
pretty confident that it was

00:43:19.497,00:43:25.403
working. >> So fascinating work
with some pretty ground breaking

00:43:25.403,00:43:29.107
implications. I mean given the
fact that your intent is to fake

00:43:29.107,00:43:32.310
people out to believe that these
are real. How do you sort of

00:43:32.310,00:43:37.181
pass the Twitter touring test if
you will? >> Yeah that's a

00:43:37.181,00:43:42.520
really good question. Um so the
the turn test now is um it's

00:43:42.520,00:43:44.322
really interesting I think
there's even conferences

00:43:44.322,00:43:48.960
dedicated to um having machines
try to bypass or try to pass the

00:43:48.960,00:43:51.963
turn test. And so there was kind
of the much simpler version that

00:43:51.963,00:43:54.899
was introduced much like 50
years ago or 40 years ago or

00:43:54.899,00:43:57.301
what how ever long ago it might
be. And nowadays you actually

00:43:57.301,00:44:00.471
have to check a lot more boxes
in order to get past it. Um yeah

00:44:00.471,00:44:04.375
I mean given our click through
rates it seems like Twitter is

00:44:04.375,00:44:08.479
uh is super super easy to do
this kind of thing on. I mean I

00:44:08.479,00:44:11.215
would argue that each kind of
positive results here in our

00:44:11.215,00:44:13.784
statistics is more or less
passing of the touring test.

00:44:13.784,00:44:19.557
Right? Um the Twitter turning
test as it as it were. Um yeah.

00:44:19.557,00:44:23.261
>> For training the transitional
probabilities on the markoff

00:44:23.261,00:44:26.097
model did you only use bi-grams
or did you consider using a

00:44:26.097,00:44:31.102
bigger window? >> Uh right only
only biagrams. >> Only biagrams.

00:44:39.844,00:44:41.546
>> Yeah. Thanks. [pause]
Alright. Thanks again. Thank

00:44:41.546,00:44:42.079
you. [applause]