All right, record to cloud.
Good evening. This is, May the 18th Wednesday. I mean May the 8th Wednesday, 2024.
This is the bookend for the St. Louis Unix User Group, general monthly meeting.
Slook and our usual way of doing these meetings is we put all the announcements in the middle So, before start out with a, tutorial and our main speaker later tonight is Tony Zaporopolis he's talking about cybersecurity and AI.
For our tutorial on the front end tonight. We have, Grant Taylor and Lee Lambert.
They're going to do the 1st of what we think is going to be a series of tutorials on sniffing.
Sniffing the network. And so with that, I'm going to turn it over not your favorite distraction.
We're talking about network here.
No, Gary, don't turn it over. You got to do the middle. The announcements, etc.
This is in the middle yet.
You said you were going to turn it over. Or maybe I miss her you, sorry.
I'm turning it over for the, tutorial.
Right. We do the middle in the middle.
Who is this scary admired guy?
Oh, and I'm sorry, that's okay. I was supposed to identify myself.
I'm Gary Meyer and I'm our MC for the evening.
Okay.
I'm Stan Reichardt and then vice president of this.
And, our treasure is also our 1st speaker this evening, Lee Lammert. I suppose say something?
Sure. Hi, I'm late.
Hi, I'm Grant. I'm the other speaker with Lee.
You got it now. Work to have and 2.
And I hate Zoom sometimes.
There you go. Share screen.
Well, he's looking, by the way, I should have also pointed out probably that yes, we are recording the meeting, so if you say anything or turn your camera on, it will be recorded.
Anyone really objects to that, let me know, say something now and we'll figure out what to do about it.
Alright.
But be aware, anybody can be recording this meeting.
Yeah.
Good point. If if they have the traps to set it up.
Lee, what happens if I say I object to recording my presentation?
I don't.
I get into the curve.
The
In the in the past, we have removed the recording from our.
Yeah, so. Somebody's got a heck of Lee.
Yeah.
Well, of course, I got the ultimate heck. I like going to pull a network.
Yes.
It's good to be this. Yeah, alright folks. We've been talking about this for a little while and by the way, Lee Lambert again.
Chief scientist at omni tech also clean the floors and fix the plumbing and do all kinds of other shit Anyway.
Sounds like a.
Yeah. I sort of drafted Grant. Year over the last month. Because we've got some issues on Bach, which we'll get into later.
Where we need to actually. Troubleshoot with the traffic that we're, is in and out of Bach.
And very few people around here know enough about. Troubleshooting a network connection. If you will, where you're actually looking at the data out there.
So it seemed like a good idea to hook Grant in and get him to help out.
Anyway, I'm Elite. Grant, say hello, Grant.
Hello, Grant. Unix Gray Beard here.
Nice slide. Nice slide, Dick. I haven't seen it yet.
You got it. Basic. Go ahead. Okay.
Yeah, yeah, I know.
Alright, okay, so. My idea here since this is a tutorial, we're going to keep it short and simple, but.
Number one for folks that wanna come back and review this later, I wanted to give you a slide deck that gives us some perspective and a little history.
And number 2, I wanted to make sure that everybody was familiar with the terms that we're gonna be using here because.
It's gonna get a little complicated. So to start off with. Today, everybody's in the tech world.
Hardware and software is, is everywhere. One of the problems we have though is that a lot of the vendors like Microsoft, Apple and some of the biggies.
They like to obfuscate all the nuts and bolts. So if there's a problem, there's absolutely no way to figure it out.
Okay.
Unless you start paying somebody that has or support contract. It also makes to understand all the moving parts. But there's 1 given.
For all these applications. Every device we're talking to talking with are involved in providing data to us.
Uses the network.
Those networks are faster than printing paper or sneakers. They leave huge distances and a single bound.
And they're required for all people and businesses today. A network though or must have fundamentally Media, be it wireless or radio.
Also known as layer one.
Okay.
Okay, I wasn't gonna get that complicated, but feel free to chime in. There's a protocol involved.
If you run talk about layers between median protocol, you've got the structure of the packet that's sending the data out on the media.
Then you got a protocol, their protocol operates on a specific port number or 65,535 available.
In the in that world. Just as and this is an offset. One of the things I believe is in is security by obscurity.
My standard SSH port is 65 0 22. Which means the chances of a network scanning are finding it are very remote.
Why on the play, but that's another conversation.
And then you've got the packets, which technically as layer 2 would be up there toward the top.
And again, this is more of a reference. So anybody can download the slide deck. And visualize the discussion.
So the issue with Pat with a question. Yes, As far as that being tough to find in a scan, that's because most scans probably are being done from 0 and counting up from there.
Well, in most scans you're going to stop at 10,000 or 20,000 because Nobody runs standard ports.
Outside of that range.
The flag on the play was that mentality. I have seen lots of evidence is about 15 years old.
True.
I've seen things scan all 65 K. Ports to find what they wanna connect to.
It happens more now than it did. 10 or 20 years ago.
Yeah. At least we're not making it easy.
Great.
Okay, so the question then is If something is not operating as expected. If it is breaking, if it's not breaking, if something is going crazy.
Most systems and applications do have log files in the Linux world. We've got slash bar slash log.
Is same in the Unix world. There's hundreds of log files in there from different applications. You can tell a lot of things from the log file.
But some of the services don't log with the information you need. Sometimes. This not timely. You know, there's all kinds of issues with log files if you have to identify the exact data that's causing the problem.
So the question is, what if you Need to solve a problem and you can't find and proper information and in a log entry or the log is not available.
What you want to do though, you can and there's many tools out there and that's the point of this series of presentations.
Is you want to actually look at the packet traffic on the network.
Okay.
There it is, sorry. Which you what we're gonna talk about doing. Is capturing packets on the network.
Using a piece of software or a piece of hardware. In the old days, you had a piece of hardware because the systems didn't come with utilities that you needed.
So you plugged in a piece of hardware, of course there's all kinds of network issues with that and it doesn't work that well today.
So today, more typically you're going to be using a piece of software or utility software. Most mixes come with some different with different flavors of the tools we're going to be talking about.
In other cases, you can get them from a 3rd party source.
In the generic world or the generic term though. I looked it up on Wikipedia. And they call all of these tools packet analyzers.
Being computer software hardware that can intercept and log traffic passing over. Digital network.
That is the definition of. Hey, packet capture tool.
So basically what you do is capture actual packets on the network.
And we're going to show you how to do it here in a little bit. And next month we're going to look at different ways to interpret the data.
And more on data collection.
By captioning the actual packets you can see exactly what is moving on the network. For the application that you want to look at.
Yeah. Traffic that you want to capture on the network.
That's, yeah.
I think you wanna find out whether or not.
Gosh, I forgot what I was gonna say. Sorry.
Mingo.
You determine the service and then find the port that goes to that service.
Yeah, I was gonna say IP or port.
Right. Well, the, you know the IP of what at least one end. Of this of the traffic.
So, so you know what interfaces it's coming on. So the, quite the issue is the port defines what traffic is being transmitted.
Who knows?
I agree that you normally know one interface, but I've had many times where I'm on a server looking at something.
It's got half a dozen interfaces and they can't tell me where it's going.
So I end up having to look at all the interface. Hopefully, you know, but. No.
Good point. Good point. Yeah, and especially on servers nowadays. You don't know which ones are in use and which ones are for internal services.
You know, like there may be a bunch of different interfaces for Docker. For virtual machines for things like that.
So sometimes it can be a good hunt.
So once you receive the data then. You have to reverse the process that was used to put them on a network.
You have to know what you're looking at. You have to know what to lay out of the packet is a lot of it's standard.
But the important part that you're going to be looking for is the actual data that's being carried in the packet.
And ask and take some work to decode.
Some practical examples. We mentioned DNS. DNS traffic is an issue or could be an issue in the.
1, 2, 3.
D Kim, that's a separate topic. See again.
The, is a security handshake for email. We even having some problems with that on Bach.
One of the components of that problem is the DNS traffic, cause there's different pieces of the puzzle.
We'll be hopefully getting into that later.
Other examples, network printers, sometimes you have printers is just don't want to work.
Troubleshooting of various clients. I'm on. That's a similar Nagas, isn't it, Grant?
Yeah.
Yeah, I've had to do network, you know, we've got like 50 or 60 hosts and 2 or 300 services that we monitor here on our Sometimes they don't work right.
And it's a lot easier to troubleshoot them. If you can actually see the data that's being passed back and forth.
And is looking at a log file. Of course you might always want to impress your friends by telling them what their password is and hint.
Learn something new. I love to do that. System and across the aisle from you.
Tonight we're going to start talking about the or one of the lowest level tools TCP.
This is standard on most mixes or at least available in almost all. Next systems, Open BSC, Freebsd, Net BSD.
Almost every flavor of Linux. It is a very straightforward packet capture program. That enables you to capture packets from an interface.
Why are shark then is a sophisticated tool that allows you to analyze that data after it's been captured.
And interpreted. Again, that'll be one of the topics here down the road.
It can also do captures directly itself.
Okay. Some of the other free open source versions, Etherape, Ether find and Snoop.
I think that's Solaris and there's a few players on Windows. Is this in their Wireshark version for Windows?
There is.
And it's free.
Okay, I thought there was but I didn't know for sure Cause I do not play in the Windows environment.
I don't have those kind of shackles.
I was actually introduced to Wireshark's predecessor. And I, No.
That saint.
Ethereal. Back in the late 90.
Okay.
Okay, that was the area was after NET. I think wasn't it? Yeah.
Cause anybody tell me what the.
Come on now. Grant, you know?
No, I don't.
Nagios. Nagios ain't gonna insist on sainthood. Oof.
Anybody should be able to guess that one.
Yeah.
Say.
Of course I learned that at the Nagas World Conference about 15 years ago.
Of course they're all kinds of commercial flavors out there. I just grab this list offline real quick or online real quick.
I actually don't know any of them. Grant, have you played any of these?
No, I haven't. Solar winds I've heard of. But not in a good one.
Like.
Okay. Okay. Alright, so. The goal tonight is to get TCP dump up and running.
Okay.
And if you Feel so inclined. I would encourage you to follow along here in a minute. 1st thing we're gonna do is install TCP.
Okay.
App, gum, zipper. Whatever your package manager has. Go ahead and do it. I'll give you a few minutes.
Well, you do that, I am going to find my show window here.
I just checked the. Wikipedia and apparently Wireshark is available on Windows.
Yes. It is. I've run it multiple times.
Everybody see the show window I've got here?
Yes.
Yes, we see it.
Okay. I'm gonna install it on this on my workstation here.
Hey, what's that password? I didn't see it.
Yeah.
Yeah. Then we need the passer to install it.
Yeah, on your machine.
She's a head bar for her friend.
Yeah, mine's already got it apparently.
I would hope he's either on a local system or SSH. And sniffing that is quite complicated.
I don't even know if SSH it's possible. I know TLS certain configurations it is, but that's a t's for a future video.
Okay, TCP down plus 2 dependencies.
Alright, what's the 1st step?
You're asking me or looking at your slides.
Oh, I don't need to.
BCP dump minus minus help.
IP numbers.
How, how would I find him?
I would.
I do. Dash A or an IP show adder.
How about IPA?
Sure.
We've got loop back. We've got an ethernet one. Got Ethernet 0.
We've got a Docker 0. We've got a couple of virtual ethernet here that aren't being used.
Okay.
In this case, I know that my, well, in fact, The other thing you can do.
Is look at your default route, IP route. And you can see that your default route is 10 0 0 2 54.
And if you look up here, the 10 0 0. Is.
Roll back down. Look on the right hand side, you'll see your source address for the link and the device on the same line.
Okay.
That is Linux specific. If config is more. General Unix or POSIX.
Maybe you have an alias for IP.
No, if you don't have IP, if config works. But, the information.
My asking if you have if you have an alias associated because you're getting caller automatically.
Is that something you configured somewhere?
No. I didn't configure it. It came with.
It came without this installation.
IP command.
Is that?
Well, it's not it's an option at IP command, but you have to you have to specify it or it doesn't.
Yeah.
Doesn't give you a color by default
This is gonna take some time this presentation. Let's talk about the IP. Command colorization on discuss.
Valid question. I just want to stay focused.
Yeah. Okay.
Oh cool.
So 1st thing you realize with TCP dump is you need route permission to capture.
By default, there should be some ways you can set privilege up. To do it as your normal user.
Yeah.
If you want if you want to jump through those groups. Or if it's if it's a server you might play with pseudo and permissions.
Lock it down to particular users or groups.
Yeah. Wireshark usually has some options where you can. Users to a group with gets permission.
And if you sniff frequently like myself, That is a worthwhile thing to do.
Are you taking notes, Grant? We may, we may have enough for tutorials the rest of the year.
Yeah.
Okay.
Yes, we have the, Anonymous coward I think is taking notes for us.
Alright, so who tells me what, what, what do you want me to do here?
Okay.
Dash I. For interface. One or 8 0 dealers choice.
Okay, anything else?
Hit in her and then quickly hit Control C.
Notice that. We have about 95% of the traffic here right now on zoom because we have a conference running.
Hit the up arrow.
And put it in it for numeric in front of the eye.
In or numeric.
Oh what?
November.
In front of the eye.
Yep.
Okay, Control C.
Okay.
There's a couple options.
Let's look for TCP. So. Put a space and type. TCP, I think in lower case and hidden.
Okay, control.
Okay.
Yep. Congratulations, Lee. You are using TC Dump.
Hey. Haven't heard any horns yet so I must be doing good
One of the biggest hurdles with sniffing network traffic. Is not using the tool. It's actually.
Knowing what you want the tool to do. And interpreting the results.
So Since we had talked about DNS, Take TCP off. And put port space, 53.
Okay.
So what this will do is it will. Filter what's captured for TCP or UDP queries.
We're welcome.
To port 53 which is standard dn s over port 53. We're not gonna talk about DNS over HTTPS or DNS over TLS.
Those are.
Yeah. What happened? I got a l from my friend. What else?
Every corner.
Alright, open it. Okay, there we have some queries. And we can see that your workstation.
Oh, interesting.
On it did a query for Morris rit edu and I came back as an alias, something else with an address.
Phone calls. We'll put it Right here.
In additional information. So this is.
You're
If I can, for just a second, if. Somebody could, there's a sound in the background.
Okay. Okay. That's Steve.
Steve.
Somebody's got a television or radio or It was Steve, I muted.
So we had talked about. Potential DNS issues on the sis admin mailing list impacting the mail list operation.
This is the exact type of thing we are going to want to do. And or some of the configured DNS servers.
And if you notice on left hand column. We see the hour minute second and decimal of a second.
Why decimal that many places it can actually. Catch a lot of things that quickly and time in between.
And one of the potential problems we had wondered about. Is if some query was being made and it was taking too long to get a response.
And I kind of said, network Stanford would show us that. So you can see very easily like the hit control see.
Surely.
Okay. So like on the Would you highlight? (185) 747-3683.
Yep. The second. That line and the one below it.
Oh, okay. Down one. Line, please. Yeah.
So what we have there. Is his workstation. Sent a DNS query. Per an ephemeral port.
To his configured DNS server. 53 there on. It said I want an A or a query in for an A record for Nagas omni tech.
Net his DNS server then replied a fraction of a second later. The address you want is it to 0 6 1 9 7 2 5 1 1 89.
There's the answer to your question. So that is a perfect example of the type of thing we had been wondering.
Impacting Bach like is something sending queries. And it's taking 2 1030 60 seconds to respond and Mailman is getting unhappy.
That would show us.
While we're here, I'd also mentioned that it is typical. They might know what AAA means.
I do.
I know you do.
It's.
Hey. Hey.
Yeah.
No IPv 6.
Yeah, Hi.
Okay.
It is this is and we're getting into Not only do you need to know the tool and what you're doing, but you need to have an understanding of the application.
Protocol that's communicating like you need to know a little bit about DNS. An A record or an address record is IPv 4.
Since IPv 6 is 4 times as long. As IPv 4 what they ended up doing was what they call a quad a it's just for a it's 4 times as long There's some humor in that.
Or a little.
But a quality record is querying for an IPv 6 address. And Lee, it looks like you don't have IPv 6 configured.
That's a act.
I want, let you for that, but I would kind of be hypocritical since I don't have V 6 on my home network since I don't have V 6 on my home network since I moved.
Yeah.
But I wag my finger at you.
I, I have not jumped into that.
That's a series for next year.
And just because this is a tutorial level talk for those of you who, IT is the general protocol.
IPv 6 is version 6. Version 4 was the standard for decades. And, version 6 is now the current standard, but a lot of stuff.
A lot of stuff still just runs on before. So don't worry, we'll get into that at some future date as far as the details.
But.
Yep.
Yeah, for example, little companies like. For example, ATT. You just get an IPv 4.
Address, not a 6. So.
Yeah, but they support 6.
Hi.
You know, yeah, A lot of users don't get them. I don't know how they handle it, but I said up business fiber for a client last month.
And I don't the whole modem was V 6. And there's only one IPv 4 address, which is the one they use.
Everything else was B 6.
Okay, yeah, cause I, I did the consumer grade and I'm in a neighborhood that doesn't even have fiber so I had to get the Plain Jane Internet Service.
But, in my conversations, I could have requested a static IP, which may have. Made some of the You know, the Quad A available.
But I opted to not pay the extra money till I got. To a point to where I absolutely had to have it, which hasn't come yet.
Yeah, but before you start paying money for something like that, there's a lot of other factors that come, they come into play like.
How reliable, you know, the only reason to have a static IP is if you're advertising it publicly.
You know, for, for our website or blog site or something.
I've actually requested clients get a static IP address at their home and office so I could put it into an access control list to allow them to.
Connect into something at client offices.
So.
Okay, fair point.
Yeah, I can see the value. In it but yeah I'm taking the cheaper I'm just using name.
And if, ATT changes my IP address and I'll just.
You can go to IP chicken.com, which I thought found to be rather amusing.
And it'll tell you what your IP address is. Would you be the one that. AT and T gave me and then go to your go to name.
Calm on manually update your. Yeah.
There's a fine IP address.
Before you scroll to much further, were there any other questions about the TSP dump that's on screen.
Can you save it to a file?
Sure, you can redirect that output. To a file. Or we can tell TSP dump actually Lee, take the greater than one.
Off and do a Dash W for write test dot pcap. Space dash, I think, see for count.
Space 25.
Okay, on another tab open a web browser go to cnn.com or something and it will Just
Should make a whole bunch of queries.
I figured there would be more than that.
I don't have to accept cookies. Hmm.
Just go back to your control. So you probably ought to have something in it.
Yeah, and it will. I just figured it would've filled. Sooner than that.
Okay, go back to TSP Dump.
Alright, Control C. It's alright.
Oh, it so it did. Alright, now. As a foot gun, I've done it multiple times.
And that'll be a binary file.
Okay, well.
That is the actual. Yeah. Yes.
That's actual data.
So.
Although you can see strings in here.
Yeah. Do a queue to exit your, okay, now. As a foot gun.
Right.
Don't rerun the previous command. The Couple about yeah that one it will start a new capture and overwrite your file So take the dash, change the w to an R for read.
And then take the dash c in 25 off.
Hit enter. And there you go. You have created a Yes, it can. And TCP.
Okay, so reads, it can read its own output. Yeah, which seems logical.
Captures to, it's I think Pcap in G for next generation, capture next generation.
By default, newer versions do. And Wireshark and many other things. Can open that and look at it.
Lee, do you by chance as a sneak preview have access that test PCAP file with Wireshark?
If not, it's okay.
I was going to and install it, you know, for everybody while we're here.
Okay.
Shouldn't take too long, now we don't build a repos.
Yeah. But, it will open and you'll see many, many, many more. Details.
Come on, finish.
Need to turn the crank on the side of the monitor faster.
Yeah.
Here we go.
Go to file and open.
Chess peekap. Right side, middle.
So, what we have here kind of is a sneak peek. It's the top part is very similar.
Output. But the middle part is where the money is and I very seldom use the bottom part and you can turn that off.
There are a whole bunch of features that's other things. But you see that little twisty in the middle next to domain name system with query in the.
Go to the left. Yeah, click that.
And it should and Click the little twisty next to the query.
So we can see far more details. And if. Then you can see with TP, you can turn some things up.
Dns is a fairly simple thing and humans can interpret, but these are called dissectors inside of Wireshark.
And it has the ability intent. To decrypt encrypted traffic if you have the key material.
Or if you are dealing with a binary protocol like S and B Samba networking or other things.
Watershark is godsend.
Cool. Alright, I Gary just rang the bell on me so we need to wrap it up for the tutorial.
Any other questions before we go to the GUI middle?
Well, people are thinking of the questions, I'll just point out that. This is designed to be a series of tutorials or concepts of of sniffing.
So obviously tonight was just a you know kind of a 1st up, introduction. Here's what it kind of looks like.
And obviously it's a lot more questions as to where to find stuff, what stuff means. So, if any of you, You know, we're wondering, oh, gee, I didn't totally understand all this.
Well, tonight wasn't a total understanding thing tonight. Was it get your toes what? Start recognizing things.
Yeah, the whole goal tonight was to show you how to install TCP. Dumping Wireshark and show an example.
When's the next episode?
Next month, tune in next month on the 1st ones second Wednesday for the continuing saga of Grant and Lee.
Traipsing through the network. So yeah. Okay.
Go ahead and do the, middle, then there was one question that was posted. Discuss I wanted to answer.
Okay, you want to do that after we do the, okay? Oh, okay.
Yes, I have to find it. Would you feel with that air, please?
I'm sorry, go, repeat.
Would you fill the dead air, please?
Oh yeah, we can do that. We could do that. At least no problem. Okay, this is what we call the gooey middle of our Oreo cookie.
We do our announcements and the usual meeting type things here in the middle. And then we follow this by our main speaker of the evening, to be Tony Saperopolis telling us all about the glorious world of cybersecurity and artificial intelligence.
But we'll get to that in a minute. A couple minutes here. So.
Oh.
Grant did. I found the question. Gary had asked if you could sniff other people's IPs.
And I said, it depends. That has to do with like you're kind of obviously sniff what's on the servers you're trying to talk to.
And it also depends on the type of network you're on. Like switched ethernet by default it's only gonna send you things that are for your computer.
Sometimes you can change that. Wireless with web and older WPA. You have the encryption capability.
Like the actual key to get on wireless and it's broadcast. So yes, you can sniff other people's IP addresses on most networks.
Let's see. Stan, can you take over the,
Display with the slides you have for the gooey middle
I'm trying and I'm trying to find the button.
Okay. Button button who's got the button but presentable
Okay, 8 days from now is the St. Louis Linux user group meeting. And our topic this month is going to be Scott Granneman.
Many of you were here with Scott, history of computing. From the, started, 1968 the last time.
So we could just do the history computing starting in the 1,980 this time. And yeah those are you don't like history remember if you don't pay attention to history you're doomed to repeat it so And it's both comical and interesting to see what we were doing back in those days.
And the amazing thing is, is we sometimes just repeat the same cycles over and over again. So tune in next Thursday night.
At let's see Thursday night meeting starts at 7? 6 36 30.
No, it's just like this one.
Sessions up at 6 meaning start 6 30. Okay. Okay, okay. At least.
Surely that's your audio and make sure it works for the presentation starting at 6 30 on the dot.
Oh yeah. Okay, let's see. Next, point is, 12 days after that, 4th Tuesday is the new Linux meeting.
The new next meeting, the idea is whoever wants to claim that they are the newest person to the world of Linux.
Gets to ask the 1st question. And basically, emphasis is all to address whatever the question is of that newest user until there's a good a satisfactory answer we can come up with and after we get that straight now that we move on to whoever wants to say that the Second newest person in the room.
So, we still want a lot of experience uses to come, though, because it's amazing how sometimes experience users come up with different answers.
Play off each other, come up with good ideas. And as an experienced user, I learn a heck of a lot listening to, helping listening and trying to help the people who are these new users.
So by all means everybody should come. So. And that will be on May the 12.th
That's right. No. Okay, after the 12 are in part, it's 12 days later.
So the 4th Tuesday. Okay, a reminder, Debbie and Tim, long term support, LTS.
It ends on June the 30th of this year and we slug have a system which is still percolating along on Debian.
So it's got to get upgraded and they don't have a true. Yeah. So, we've got a team of folks who are together working on that.
And this is one of those things that, you know, many fingers make the work light. And also, you know, if you haven't had the opportunity at work to do the corporate system.
It's a little bit different doing a system where they're multiple users on the system and it's not just used.
This is a little different maybe than doing your box at home and if it doesn't work, I'll find out.
So, the idea here is to make sure it works and we're up by such and such a time.
So, if any would like to volunteer, please do volunteer and you can join join our crew of people working on this and they can, as you volunteer, you'll find out timelines and the ideas of what gets done when.
So, but volunteer, please. Coming up on July the 4, th That's our that 1st Thursday is our normal meeting day for the Slack, St.
Louis area computer club. That's kind of a hardware group. It's not Linux specific.
Really even talk to you about why a Microsoft program is or is working on your hardware. But the meeting for that is on that 1st Thursday.
It's July the 4th this year. So we'll have to come up with an alternative date because we figure people won't want to meet on July the 4.th
Not yet.
Stan, we don't have an alternative lined up. Okay, but do pay attention to the calendar and the.
Using and discuss and we'll come up with an alternative. And let you know. But we won't be doing it on July the 4.th
Okay. Next point, we still hate meetup.com.
I have to apologize and I' to do this earlier. If any of you got thrown off, thinking that the part of the meeting tonight the tutorial on sniffing if that was Monday I screwed up and when I put it out and meet up there was an oops and meetup.
Dot com filled in the date as Monday and my fault or not double checking and making sure but so I very very much apologize to anyone who I screwed up tonight.
So, any other announcements? Let's see, anybody got anything else?
I've got an interesting one. In reference to what we were just doing. May the 13, th on our calendar.
The reference on May the 13th is Network General Corporation was formed. And their 1st product recently for their existence was they had this new hardware box.
It was basically a portable PC or logable as we call those days. And, it was called the network general sniffer.
And, that term we used a lot tonight, sniffing. That was the name of their product.
It basically was a piece that you plugged in in the middle of the line of communication cable and all the stuff that the Lee and Grant were showing in tonight amazed people back then because it's basically a customized PC that would you know, let you look at an analyze network traffic that went by and it was something that was very new and unique back then.
So, May the 13th was the anniversary. Of the network generals never coming to us.
Used to be that computers had trouble. Keeping up with the speed of the network. So the ability to have a box that would not fall over while trying to do that was.
A feet.
Yeah, we're especially one of this portable.
Yep.
See. Also on the calendar, future. Next month, this meeting, the Wednesday, second Wednesday the month, our general monthly meeting, Wednesday the month, our general monthly meeting.
Obviously, I should obviously, but yes, the tutorial will be a continuation of tonight. Obviously, but yes, the tutorial will be a continuation of tonight.
Kind of a next step and sniffing. And there'll be more details on that later.
Our main speaker next month we'll be Scott, and his topic next month is going to be social media for techies.
And, so, I mean, there's a number of us, gray hairs in the room.
Hey, what we could just do a talk from one system to another that help us social media but now there's things like Discord and all these other wonderful things.
That where checkies get together and share information. And what are they all? Why? Why do we use different ones?
Which ones are better for different purposes? And, so Scott's gonna kind of. Discuss what these different social media platforms are and which ones you might find appropriate.
So tune in one month from today. Or one month for the second Wednesday. Any other things. No other announcements we usually open for general Q&A.
At this point. If anyone wants something that they want to ask here before the crowd disperses. We can quickly do that, but also period for general Q&A after our main speaker tonight.
I would like to throw out a call for if you have questions about sniffers. Please send a message to discuss or my email is on there.
You should be able to email me directly too. I wanna make sure we cover everything. People wanna know.
And it was pointed out earlier. I'm sorry to identify myself. I'm Gary Meyer and I'm the MC tonight.
Hmm.
Any other questions?
Hmm.
I'm trying to find the button.
But button button got my button.
Yeah, I'm not sure if we can help you stay on with that.
Gee, oh, there is.
Something's in chat. Let me see if we're getting a chat message for somebody.
I hate Zoom. Gosh, I hate Zoom.
I think I'm gonna give up here.
You know, it's a shame that you don't have anything on your schedule.
And Stan, why don't you bump that about 3 times? So, we, somebody else has a chance to see it.
But for those of you who may not be familiar with it, There you go. We. We've, we've tried, to Our original intent, I should say.
Was that we would not just have a calendar with our own meetings on it, but we try, we try to, put the other meetings that we thought people would be interested in in St.
Louis. And, since originally was kind of a St. Louis oriented calendar and we still do try and pick up any.
Computer techie type meetings or scientific meetings. That we think our people be interested in here in town.
What stands demonstrating now is you can click that little thing at the upper right hand corner. And you can select different things, right?
Now he's got a set of slug sponsored events. So those are the ones that this group does.
By the way, if you attend any 2 of those sloop sponsored events during a calendar year.
You're a voting member. There are no dues for this. So you can vote next year if you've been here for 2 of these meetings.
The other things on their St. Louis local events, if you want to click and just look on that, we try and make that particular category.
Meetings which are taking place here in St. Louis again when we were restricted to physical meetings that was an important thing.
And but now they could be St. Louis events but still perhaps only on Zoom or something. I just see.
And the other category remotes and online. Since Since the age of COVID hit. And our group got so used to running.
Zoom Meetings, Gypsy meetings. We found there's a lot of other really interesting groups in the world.
Hmm.
So we've got things on the calendar from Munich. One from you know, all other parts of the world because it's some topic that some of our folks are interested in or should be interested in so We try and list a few of those as we as we see fit.
So. Yep.
Is there a suggestion? Can I ask for suggestion on the calendar if you go back to the calendar? Could we have a
Stan, can you go back to the calendar, please?
I lost the button again.
Try all the.
Okay.
There it.
There we go. There we go.
So the, the, selections over there could. I know you have a bunch of on here that are have the X in front of them that have or that are Kind of default now they're not really happening anymore so maybe we have a a category for, you know, deleted meetings or no longer happening meetings so we could uncheck it.
You know what I mean?
Okay. Yeah, yeah.
Okay.
Well, one of that involves, how many volunteers we have. As far as I know, we've got Gary and myself volunteering to do the calendar.
And I've been known to sleep and eat and do other things besides mess with the calendar.
And although it does look like there's a lot of X's on the calendar, we actually have been deleting groups which have ceased to function.
And so the
Like that the 1st one I see there is what the, 1030 a. M. On May first.st
Huh.
XGO. Is that, is that canceled? That's a camp. That's no longer happening or.
Yeah, oh, that particular meeting.
That particular meeting isn't happening. It's a regularly scheduled meeting. The only reason that meeting isn't happening is there's a large physical you know, annual gathering which starts on May the 5th and so the people who normally would be doing this
Well, yeah, made it 1st is over already. So I'm just pointing out that was an X in front of that.
Yeah.
Alright, but it was cancelled on May the 1st even though it normally is scheduled for that day. But yeah, I know what you mean.
There are some meetings.
Yeah. We've had people say that, the apron like to the cancel stuff to stay on the calendar so they know something
Well, yeah, I mean, we can keep it on there, but it just keep it as a filter.
I see.
So you could just, you know. Uncheck the box unchecked the box so you don't have to see them if you don't want to check the box.
Okay.
No, that would require a human being to put them in the right category, which means that you need a volunteer.
Are you volunteering?
Got it. I got you.
Okay, okay, this is not a challenge to get volunteers, but volunteers would be appreciated, but, it's good just to have the information, but volunteers would be appreciated, but it's good just to have the information, it'd be a good thing to do.
But, it's good just to have the information. It'd be a good thing to do.
So thank you for pointing.
It was that Stan's been doing such a wonderful job.
Shucks making me blush.
Oh, thank you. I thank you. Stan. And, okay.
In a nonprofit if you say something then you It's up to you to do it. So.
Behooves you to be quiet
Yeah
Yeah. Yeah, where's your wisdom, Mr. I'll fight against that.
No good deed goes unpunished.
Yup, yup, and I'll find against that and say, hey, just knowing that it's a good idea that we do it differently is good that we know and and so thank you for pointing that out.
Yes, we'll look into seeing how we can do that. So. And there actually is a another category that we don't show on there.
We've just been calling it hiatus. And yeah, I have been dumping things which have died.
They're no longer around into the hiatus groups. So, but we'll see what we can do about, making.
Making that happen. The way you described. Okay.
Anything else that really needs to be done here in the GUI middle?
Not hearing anything. Our main speaker for tonight is Tony Sapperopolis. Tony is a long time member of our group.
Fix virus.
Been active and a speaker on many occasions and his interest is basically computer security. And he's got a he's the principal of a company called fix fix my computer I believe Yeah, 6 virus, I'm sorry, fix virus.
And.
I never did change it, but it's it's fine. At this point, don't bother.
Okay. And, so it's maybe notice in the news, the hot things in the news these days, they're artificial intelligence.
Cybersecurity. My gosh, what happens if you have the 2 topics happening at the same time?
It seems like there's an overlap. And Tony is going to tell us all about the goods and the bads that could be happening with that.
So I will turn it over.
So I get I get to share my screen I guess.
I'm admiring the server behind you.
Right. Yeah, that's a, it's an old server.
I've got one.
No, very good. I, I, was on that project a long time ago.
Okay, I guess where did I?
Name challenges, cybersecurity faces today.
Yes, good. I got the right the right screen.
Trying to get the number 2 screen good. All right, anyway
So,
And I'm always looking at the cybersecurity and AI. Because I'm in cybersecurity.
So this is like a monster truck or trap. Topic. I did a little bit of research in the last week, but I mean I've been doing lots of research.
I bought many books.
So. Mean the main thing that I wanted to kind of say is that obviously Cybersecurity is a large topic.
And you know, there are also, you know, pen testing and defense so Where do you use AI?
1st of all, I guess let's just discuss AI a little bit. I know that's like a Crazy, marketing term, I guess.
But, well, let me see here. Let me get. Let me get this guy up.
I found this. This guy is from IBM. That's an IBM.
YouTube video. So he made this little, I guess. Flow flow flow flow of traffic.
Where the user This little smiley face. Now you can see that, I hope.
Yep.
Okay. So then. So the user is making some kind of a request.
And so the domain. You know, it gives, it has to go grab the information. And then send the.
Send their information back to the user. But for whatever reason. If the attacker does it correctly, you know, you're doing.
Something incorrectly. Whatever reason now you're getting this malware. That is now gonna go, I pass all your defenses and.
Just go right back into your machine.
So anyway, that's kind of what he was talking about. So, but in general.
We've got AI which does investigate, identify, report and research because
So going back to what AI is, I guess, you know, you've got Machine language, machine learning.
Deep learning.
That that's really what the 2 the 2 main AI software pieces are is the machine learning and the deep learning.
These days, I mean We also have the large language models that the Open G chat GPT or Open AI.
Which I guess that has been involved as well. So that will allow us to, so, talk in our native language.
They call it the natural language. Instead of having to know programming, you can just say Create a script.
Of ABC in this. Programming language. And then it will generate it for you. Course there's caveats in that but That's the general idea of the the overview of kind of where where we are and a little bit of the breakdown of of AI, I guess.
I got another one of this is So here is a machine machine learning and deep learning and then He did this is I think this little tiny box which I'm which Unfortunately, my,
Transcribing here has blocked it. I like to leave, leave the transcribing on.
But like, Gary was saying, there's a Intersection. Between AI and cybersecurity.
Which is kind of what we're gonna talk about. So on the offense, what does that mean?
So basically anything that uses a lot of language. Or can for the language for the large language model. So if you're doing some kind of.
Fishing. Then you can check, you can have this. Hello.
And a better fishing attack. You know, I'm sure you guys know that. You know, we have chat GPT and lot lot of these other companies Who's sprung up?
I use. I don't use chat, GPT. I use you.com.
Mainly because you.com gives you the link. And I don't have to pay the At least I don't I haven't tested the Paid version yet, but
So it tells me all the links that It, grab the information from. So that way I can double check it if I need to.
So.
And then so besides fishing.
The machine learning. I don't know if you guys Somebody understand the difference between machine learning and deep learning?
I mean, I don't wanna go into the. True details between it but
And.
How about the quick version?
Quick version, machine learning is basically Like a bunch of if then statements. But obviously at computer speed.
So you can train. The program. And by feeding it, you know, 100 if then statements.
So if this is the case, if A is the case, then do B. Or do X or whatever.
So as you train it And the more information, if the AI is all about feeding the program information. The more information you feed it, the more You're working on your If then statements.
Then the better it becomes. So the machine learning becomes better and better as time goes on. And obviously, you know, I'm using small numbers.
These machines which have these monster trucker CPUs should specifically build for this. They're in the tens of thousands of dollars, these Especially by Nvidia, they're the They're actually graphical processing units.
CPUs except they are a very very large except especially the
The ones that are built for this kind of. Method of programming. So now you're feeding it millions and millions of lines of code.
And, it, it will figure out what is. The correct thing and that's how Basically a fancy way of searching the way I've been doing using AI so By the way.
All the things that I'm going to show you besides this YouTube. Video, of course.
I created out of different questions. Do you.com.
So anyways, so the deep learning is. More sophisticated than if then statements.
So, okay, I'm not a, Research fellow in deep learning. So I. I don't know exactly what it is, but Let's just say.
Instead of Justin if then statements you can tell it's More. Programming, algorithm. Items.
And it's some of them are really good where they can learn themselves, but
So it all depends on how sophisticated the program is. That's basically the the short version of Machine learning is.
Simpler and it does A few tasks very, very fast. Deep learning is. It's as complicated as you make it.
And it does, of course, the same thing. It does. All these tasks very, very fast and you know the Cause they're throwing Very sophisticated the hardware on on these projects.
It depends on, you know, however big you wanna. Build this and how much money you got. That's that's the bottom line.
So let's yes.
Hey Tony.
Turn that up. We can. We can't read the, the text message behind it.
We just got the the picture of the guy there in the way.
You can't read this.
Oh, you're reading it off the slide. Okay. It was off.
Yes, just I'm just this is the overview. I know I'm doing a bunch of different things
Okay, gotcha.
So let's just talk about this is the offense. And this is the defense.
Okay.
Yeah, you're right. You can't read this. This is, there's nothing really there.
1, 2, 3.
Okay.
But anyway, this is just like the beginning of the presentation here.
Alright.
I've got a few other slides and I'll get a I've got a lot of text we can read if you want.
But anyway, I can And I did find some interesting tools and. Supposedly some of them are open source, so we'll see.
We'll, we'll see about that. I'll tease you a little bit. Anyway, so let's go.
So fishing is basically a large land. It's a language model thing because you're wanting to create.
Better ways of tricking people. So we're talking the. These are the.
The the attacks. So the, what, you know, the red team in, cybersecurity.
So malware, how you know, you can tell it's, you know, I don't know if you guys know, but.
The the attackers the hackers have created their own Chatty pity. Companies or you know entities which just churn out while we're at malware.
And they do these, they turn out deep fakes, they turn out misinformation. And fishing.
And, you know, I mean, that's just what there is a bunch of, there's a bunch of them.
It doesn't really matter. I mean, We can all name them and we can read about them, but you know.
To me, it's not interesting. That I got hacked by, Babc. I got hacked, so.
And I got heck because I didn't have, you know, the patch installed or. I was misconfigured.
So it's my fault. It doesn't really matter because ABC attacked me. Big deal. I don't really care what it's called.
So anyway, let's talk about The defensive, AIs that we're going to.
We better be built some some of the companies are building diligently. These AIs. Engines and stuff so that because they know that These guys are building the attacks.
Are going to get more sophisticated. And I don't know if you guys, let's go backwards.
That's go back to the the tug of war between offense and defense And in general about the AI thing.
So I don't know if you've heard this. Like analogy kind of where you know there's a chessboard and all the the the squares on the chessboard.
You know that the doubling, phenomenon where you have You go to the, there's some kind of story about going to the king and saying You know, can.
I'm going to give you You know, 15 squares of the of the chessboard and I'm going to double the rice every time I put it down into the right into the square.
To the 1st row is not that bad. If you're doubling, you going 1, 2, 4, 8, 16, and you know, 32.
Thank you for 1 28. You might be at 5 12 at the end. But then the second row obviously becomes 1,024, etc, etc.
Now you're in the Tens of thousands. So what they're saying is that we in the
The speed of the the AI. Technology. We're into the other side of the chessboard.
So, you know, there's 4 rows. Time's how many ever there are on one side.
The other side is the other the last 4 rows. So in those rows, we're going to, we are now.
Doubling every square. But now we're in the, you know, billions and. Trillions of device cubes or a rice.
Little rice, little pieces of rice. And, kernels, whatever. Whatever the heck that's called.
Anyway, so now every time I double. It's billions and 2 billion and a hundred 1 billion and Trillions and penetillions and whatever else is going to come But the time is at the very end.
Are we going to be able to understand? What this AI is even going to be? Because it's speeding up so fast
We're, we better. This is why the intelligence companies on the defense. Have to build AI into all their programs.
And if they don't, there's offensive AI is going to blow them away and they won't even notice it.
So that's the thing and that's kind of why I wanted to Make sure you understood the.
The enormity of the. The unfortunate problem we're in. So we all have to learn.
How to deal with. This AI as much as possible. So every time you are.
Thinking of, you know, how to do something. On Google or you know obviously it's between us so I don't use Google anymore, obviously.
He was start page, duck, go. All the rest of them. So instead of using the go I use you.
Dot com And if I use the research section
It actually goes to 20 to 30 different websites. And then calculates and looks at all the information and then Spits back at me and answer.
For one thing, what I did was we were purchasing a car for my wife. I did some analysis is between a couple of different beagles.
So that's, you know, it's kind of interesting the kind of ways you can use AI.
We have to start to learn how to use AI more and more every day. Because These guys are doing it and if they're doubling every, you know, however long it is every 6 months.
Next year, the year after that. They're going to be so far ahead of us. We're not even going to understand what they're doing.
If we don't have AI on our end. So obviously we're gonna have to have AI to understand their AI.
So we have to be able to analyze.
Now, I, you know.
So, analyze is like a machine learning. Automation is where you're anticipating you're using deep learning.
Summarize. Where you're also using the large language models and the generative AI as they call it too.
This is interact. I know he wrote the, look kinda funny.
So interact in natural language. This is generate playbooks. So, you know, when you're in a, this is a hot is hot thread hunting.
So, but I don't know if you know thread hunting, but. Let's say, you, wanna be able to find the attacks in your network.
Do you have to assume they're already in your network?
So if they're in your network, how will they act?
That's what thread hunting is. So you're looking for The signature of Some do some attacker running around doing what they do.
So you, you have to use the AI that we're going to build. To try to find these attackers.
With the new malware that they're building. On the fly. So you know, just to give you an example.
So if I year from now. The attackers create malware that is specific to you. That you will not be able to.
See, unless you have A.
And then you've got ransomware. Now you've got to pay them. That's the whole point of it.
That's why we have to catch up. It's always the struggle between offense and defense. So anyway.
I guess I went over some of these things here as well.
Faster, easier, misinformation. Well, we all know what this information can be.
I don't know if I really need to get over that. Deepfakes is a good one, which as you know the If they can see a video of you like that right now The video of me can, being then created.
Into some kind of.
Some some kind of video. And actually I tried to do that myself. Courses of freebie.
Where they put it. Oh, here it is. Course it didn't actually do that. I had fed it.
My, my, My video, this is one of my videos. We don't need to watch that.
That's just something else that I created a long time ago. Then I gave it some Text.
And I don't know if you guys can hear this or not. Our online world by using smart algorithms. Let me just stop it.
Can you hear that?
Barely.
Okay, so I guess
I guess it's just going to go through my speakers and
Alright, I'm gonna have to turn it up a little bit, I guess. I don't know how I can.
Feed it straight into. Zoom, probably not. I'll just turn it up a little bit more.
Can you lean your headset in closer to the? Speaker.
Yeah, yeah, I guess so. There you go. Go on.
And come through fine.
And cyber threats. Just like a superhero with super senses, AI can quickly spot unusual activities and potential attacks.
Keeping our data safe from cyber villains. Bye, analyzing patterns and behavior, AI can predict and stop cyber attacks before they cause harm.
So next time you browse the web or send an email, remember that AI is working behind the scenes to keep you safe in the ever-evolving digital landscape of cyberspace.
Yeah, can't you find a dandy?
It wasn't very long. But I created this. Yeah, cause I, because I, increased the boy anyway.
So that little video I created. Using, you know, some some entities, text to speech. I thought they were gonna do a little bit of a deep fake, but I guess they didn't.
Anyway. So they, they, what they did do was if you notice that created some kind of Like, Images are based out of the The text that I gave it.
Which was kind of interesting, I guess.
So, I mean, you know, and this is the thing is these guys will play with that kind of stuff and until it until it does what they wanted to do, I guess.
So, okay.
What else?
So I guess what they what this guy in the and IBM and all the rest of them on Pelo Alto.
Their big thing is that we wanna be proactive instead of reactive.
You know, if we're reactive. We're, it's kind of too late already.
Because the AI is moving too fast.
So here is I found a few. Tools. Apparently I haven't really checked these at all yet, I guess.
I guess that's a future. Future something. But I wanna do some testing on some of these.
But apparently Google's Magica is open source. Hey, Powered tool.
And that's a, it, you know, identifies, malware.
Amazon created, created the Sagemaker.
So I know it's to do with machine learning model. So this is the if then stuff
And then trend micro as a
So it's a GENII tool, so that's more like chat GPT.
So that's to do with the threat investigations. So they're probably gonna build that into their products.
Hello, Altoos, I saw a video of theirs and their
They're building this stuff. Into their products. And there's going to be a version of it, a very early version in by July.
So you know like the I don't know if you guys been watching The market at all the, you know, the stock market.
AI is like constantly being talked about. And for that, and video and all. And all the other companies as well, but
These guys are buying all these huge hardware and I I don't know if you know what Nvidia is selling.
There's selling these 100 $200,000 processors. I think they may be more expensive, but those are The basic ones.
Anyway.
So, central one is another company. I've seen them in the cyber security conferences around town.
So this is to do with the threat hunting.
So I don't know if you know purple AI purple means. Both defense and offense.
New caller.
There's a new color.
Is Huh? Yeah, purple. Yeah, purple is. Both defense and ops.
Yep, if you are not aware of that. So all these are the companies. This is like one of the, this is a kind of a new company that's.
Probably, you know, made, I raised money and is creating this product.
I don't know, I have to do more research on it, but that's my guess.
And so, okay, dark trace. Yeah, I don't really know that much about them, but these are just some of the No, I also found This here.
This is more like a little bit more of a background.
I don't know if you guys are familiar with manual threat, thread hunting.
Now one of the things that I do is like one of my clients They don't really understand what I do, you know, they're like.
I guess they do. They are happy that they haven't been hacked, so. No, I don't like to say who I have, so it doesn't really matter.
But way I introduce subjects to them is I For example, I say like every month. I'm doing 2 h of thread hunting.
They haven't really asked me. What am I paying this for? It's kind of funny, but.
If they do, I'll explain it to them, of course, but. I mean, I'm obviously looking around all over the internet to see if there's any Possibility that You know, we are more susceptible to a certain threats.
And then I would review. Our Zoom and our logs to see. Anything like that is going on.
But it's
So you look to see what the current threats the current tools that are being used by the attackers. And then your checking to see your clients vulnerable to that tool.
Right. That's correct. That's you it's a like I said it's a constant talk of war and usually the attacker has the advantage
So one of these, you know, Palo Alto, it seems to Be I was slightly ahead of the game, of course.
As far as the firewall goes, they're probably not. The least expensive one.
But the, from what I understand, they are more like an IPS firewall. So they're They do both.
But usually these days, I guess most everybody does that.
So.
IPS, like a wall being.
What time? Yes.
Well, so it's a layer 2, you know, back in the day. And I was at We had IPS systems that we ran.
And I was part of the team that set them up all across the world.
So IPS is intruding prevention systems. And it's basically a layer 2 device. That looks for certain signatures.
In the, in the second layer of the network. To see if if something is bad or good and then It literally doesn't allow it to to operate.
So the Palo Alto is a firewall that has the capability of an IPS.
If you want to use it that way.
So, okay, so, you know, it's, I'm sure we'll have more ways of using AI, but
An AI in vulnerability management. It's kind of interesting. We would. I do this quite a bit and I do a lot of it.
Very, manual method, of course. You know, I use the green bone. Well, ability manager and I do have it do The scanning on its own.
But you still have to check the
The different vulnerabilities and it doesn't really create the reports very well. I'm sure it's because we're not paying for it.
And hopefully they have better reports on the paid version.
So, okay, let me remember I saw When I talked to Gary about this
Presentation I really just wanted to keep it very basic and like an overview. And maybe there's something else to be talked about.
So I guess the meat and potatoes is really this.
This, we're document that I created. Out of several, like I said, IR several.
Question answer sessions with you.com. And I tried to. Increase the size of the.
The bots here.
So I again, these guys talk about dark trace.
So, you know, I asked the different questions like, What are some AI power cybersecurity solutions?
So.
The automated incident response. A. I.
Uses artificial neural networks.
With ability management, it's interesting that there's nobody. With that, at least that the That you.
Dot com phone anyway.
Thread hunting victory. I sent an old one that's the the one the other one answered as well.
I'm just gonna go through these. A little bit faster, I guess, because I don't know.
You guys have questions? Speak up.
Hey, I powered risk assessments. Assessments.
So. So we, you know, I'm part of ISAC. So that's kind of what we do is risk assessment.
A lot of people in I just came from a social, meeting. From the Firefly.
We had to elect the new new officers and stuff. I guess they just wanted to get together and get a free free beer.
That was good. But anyway, So we, the ISACA people are auditors. Risk assessment management.
Those kinds of things. The That's most of the Employees are the members of ASACA are I, to do with risk assessment and auditing.
Like I'm with Yeah, compliance. I do a lot of PCI compliance stuff.
So we're not actually manning the and point security. We're not actually manning the firewalls and stuff.
We're We're checking to make sure everything is working correctly.
So I guess where my what my point for this is Last year. We had a presentation with chat GPT.
One of the companies one of the people said that they were starting to use Chat GPT. And they had their own instance of Chat GPT in their company.
And what they were doing is they fed it all the information. The they had.
And it's, it's for like all the projects and different. Information that they were you know I don't know how many clients they have and I don't know how much data they actually have they It's probably way overkill for what chat GPT can do.
Did you know it could do a lot more than what they're feeding it? But that way, what they can do is They can tell it.
Create the report for me if I say this this and this
So it's basically like a fancy version. Of our risk assessment program.
And that's what they're talking about here. You can do different, you can obviously this was also the earlier version of chat GPT so.
Maybe it wasn't as capable back then.
I mean it was like version 3.5. I don't know. Now we're like hit 4 or 5 or something.
Anyway.
Okay, so for risk assessment then. It looks like 2 parts is the analyzing threat intelligence. And user behavior pattern.
So for user behavior patterns. Do you have to give the? She. The ability then to monitor.
What everybody's typing. I mean, privacy is obviously Not.
Well, this is the thing it's that's why it has to be at the at the office.
Is that the office you really don't have privacy?
But yes, I mean, we, Palo Alto. It's also. It depends on what we're really talking about here, okay?
So you're saying it's what they're typing but Maybe it's what they just enter and Send through the network.
Okay.
So maybe it's not what you're typing, but it's maybe it is what you're sending from one computer to another.
Which which file are you accessing? From the the file server. From the email, are you downloading email?
Are you going on the web?
Or maybe you're going to a. A client. Not a client, but a vendor.
Yeah, website and now you're downloading you know something from them
So. You know, I mean. It depends on your regular job. What is your regular job?
What, how are you using your computer?
What kind of I guess? Probably a better way to say that is the network
The behavior of the user on the network.
I mean, obviously you can create it however you want it to so you could I'm sure the Chinese are capturing all the clicking and clacking where they're doing.
At the, you know, in China. If they if they can they can capture everything. Oh good.
Alright, this is I wanted to mention this. One of the reasons I don't really like using Zoom anymore is cause you do know we're I mean, we're basically on China's, cloud here.
And the China. Z. Loves to Grab as much information as possible. Because they know that they need data to feed their AI.
So I prefer not to give them data.
If I can, so. I really think you guys should go back to live meetings again. I know it's easy to do these zoom things And you probably don't want to use.
Whatever the heck Microsoft has. Or Google or I don't know what else is out there.
Gitsey, when we have done some of our meetings with
It's always, it works well.
Yeah, switch to.
How do you spell that?
I
Okay, I'll check that out.
Very good, but.
Okay.
Yeah, I can. Identity enacts. You know, I'm a big, Anti-china bluff person so anyway Let's not go on my side so box.
Oh, these what all these companies are trying to do is they're trying to figure out ways to use AI in their programs and they're software.
Let's have a security and training and awareness, of course. Simulating attacks.
Okay.
Yeah, of course, identified specific needs. Here's some examples of companies that you and how they're using it today.
Generative, so crowd strike, I'm sure you've heard of them. There's a cloud company.
So they use Generative. So the large language miles.
Fortunately So that doesn't so that's so in other words the They couldn't find that much information.
Except that their marketing speak has some AI words in there.
Do you have to be able to read these? Responses by the Just like you have to be able to read Google.
Google responses when you're doing a Google search. Or, Doctor Go or whatever.
Let's go. I haven't heard of Netscope before.
Twin micro. We heard of that. This is a new company. I saw them at one of the local So have security events like it.
Future con or data connectors, you know, those free ones.
They were giving out their stickers and stuff.
So it's a cloud company.
Axonius.
Annual recurring revenue chasing financial viability. Okay. Like I was the To me the most relevant of all these is Palo Alto.
Because it actually has a valid product that that they are actually, they're trying to improving, improve it with you.
Adding AI into it. Which is a good idea. So there's spending a lot of money. To to make their products faster.
And better. The attackers are going to be doing that too.
Okay.
So okay, that's it's conclusion. That's what it's conclusion came up with.
Those words together.
Okay, I don't know if you need to read that. Bachelor. So here's another search entry.
Yeah, so this is the key right here. They all want data. That so they to make it better.
The more data, the better.
Hmm. So, okay, so they're obviously there's companies that Build data. Which kind of defeats the purpose.
You, I think I would think you'd want actual data from Live something instead of generating data that doesn't make sense to me but whatever
Alright.
Well, yeah, I mean, that if you're in an enterprise which has a hundred 1,000 computers or 50,000 computers You're gonna get lots of traffic.
In Pfizer had 200,000 computers when I was there. All across the world.
Well.
So, and you know, and 3 continents, etc.
Okay.
That's a completely different story there.
So this page here basically is saying like you could use this platform like snorkel flow.
And then. What are they suggesting that as a a defensive user. I should use this to look for what?
A path of attack or
So it's just saying that
If you have a certain it's like that one company that wanted to create the own. Like project the responses or reports.
So you have to feed it. A certain amount of data. So if you don't have enough data, you can generate data.
You can tell it, you know, you can, I guess what the reason you've got this.
Maybe what it does is it goes It says poor. You know, I equals. One to a hundred and then.
Many different varieties of data, maybe there's 20 Well, I, you know, a hundred different ways of the data.
Maybe you're creating new sets of data. So just so you can go through all the the whole possible list.
Of possibility of data. And then you're creating that whole data. Cause now it's like manufactured data, but Maybe it's the possibility of All the.
The possible. So another topic here. It's okay, I incorporated, but are you guys familiar with Go?
Programming language.
No, the go the, the, the, the game.
Oh, okay, again, yeah, haven't played it a long time, but yeah.
Yeah, so it's It's different than chess.
Doesn't it have like a hundred 90
Possible places to put the pebbles on each side. Or something like that. I mean, we could look it up, I guess.
Yeah. You see.
On an 80 or whatever it is. So let's say it's a hundred 80. Let's just Pretend it's a hundred 80 on each side.
So it's 1, so I think it's like a 1 81 and 1 80. So.
You have 361. That's possibilities to put. Your pebble in the at the 1st the 1st chance So snorkel flow would then go through and say, well, I'm going to put it on this spot.
Or I can put it on that spot, and etc, etc. 350 different methods.
351 whatever.
So and then of course, you know, when you put it in one spot, then the other guy.
Can put it in the other spot you get the white pebbles and the black pebbles.
So all the different game theories of where to put Your pebble. That's I guess that's what this would That's what would make sense to me is to create if you're creating your own dataasets.
Obviously, it depends on what you're creating and
But if you're creating data set for Go. Interestingly enough. A few years ago.
When they 1st created You know they created the IDMs. Version to to beat the The best chess players.
Well, the goal players were able to beat. All these devices with the Go software for a long time until
They created an AI that was able to learn.
On its own and it actually confused the The master, players, the, the, I forget what they're called, the Grand Master's on the chess, but They the equivalent of the Grand Master on Go.
And what happened was You can completely confuse those guys and You know, there's a It's like best out of the 11 games.
So you have to win 6. Of 6 of the games. To win the set or something.
And they were they were they actually for the 1st time lost against this new AI methodology. That was able to figure out things out on its own.
That was kind of interesting, but that only happened a couple of years ago. So AI is moving along as far as technology goes.
Anyway. What else is on here?
Yeah, this is the thing. It's like. Everything's going to be different for everybody else.
I personally I think I don't
Yes, they're going to be different, but then they're also going to be the same.
It depends. And your environment, of course. I mean, if you've got standard. Windows machines.
Maybe they are, you know, 3, 4, 5 years old, maximum. What are you running?
You're not gonna be running Windows 2,000 anymore.
You're gonna be running maybe some ME if you're if you're unlucky You should be replacing those devices.
These days. What is it? The
What was that one? That's just a few years old. People still have some of these old Windows machines.
We gotta get them off of the, you know, we gotta get them to. Sell those things or destroy him.
But anyway, or recycle them, I guess.
So yeah, I mean the use cases.
These are all like I is very hard to quantify. And I don't remember when I asked this.
But obviously, you know, the other thing is
The data that we're we're getting back from these queries are always older.
So they information it found is probably from a few years ago.
So from 2022
So already, you know, we can't really make decision if you're trying to make a decision on what to.
Invest in. You're going to have to feed it. Today's data are not. The data that it can it can find on its own.
That's I guess the key is feeding its valid data If you're trying to use it for.
Financial advice I guess but What we're trying to use it for is defending our network. So it's all the depending on.
What is the correct? Information and what is the bad information.
So obviously, so let's say you Started pressing the button and said, all right, everything from 8 20 till 8th 30 is valid data.
Bye, you better not have, you know, some malware running on your, on your machines. Construct you're really scared
So I maybe the best method is to teach it. On a closed environment. With just a few devices.
So that way you know for sure that this is these machines are not attack already.
It's very tricky. These things become
Come, a very, become tricky.
So okay, so, alright, this AI suburb base threats.
This is what we talked about. AI driven malware.
Deep big social engineering attacks.
Evasive attacks.
Okay. It comes back to the The 3 or 4 different attacks.
Social engineering. The fishing and the malware. I think the In my eyes, the malware is the most dangerous.
I mean, I know. It depends, obviously, social engineering, you I don't know about you guys, but basically I don't trust anything anymore.
Somebody calls me and they want something. It's too bad. I don't really care. I have to know you.
I have to be calling you, so I'm gonna give you some information.
Do you call me out of the blue? You're not getting anything out of me.
That's basically how you have to deal with it.
I mean, even. Well, well, there was some worky method that you know somebody was sent a like, Like a recording of The CEO.
Because they the deep fake was able to grab his voice recording and They said they told Cause they found out who approves.
Up to like a what was it like $50,000 So it wasn't that much money, but 50,000 still a lot of money in my eyes.
You know for a corporation it might not be that bad could have been a hundred 1,000 millions
So this company lost 50,000 because They listened to a deep fake. But the of the the CEO.
And they they were just confused by What was going on?
So I guess what it the bottom line is you have to have. Unfortunately, you have to have 2 people sign off on it.
And you have to slow everything down. You can't, you know, every we all wanna do everything fast, but.
Not as far as when it comes to money. Everything needs to slow down.
In this day and age.
So yeah, as far as the regulatory stuff. They're way behind on all this. They don't understand this at all.
I mean, you is.
They're trying to get in on it a little bit because I mean, I don't know if you guys are familiar with the EU.
There that's just the big bureaucracy there. They think they know stuff.
But I'm sure whatever they're gonna come up with is going to be screwed up.
There, their privacy. Act that they've created has like a huge A penalty phase. But the whole idea with their
The regulation is They're very, flexible as long as you know who you're talking to.
So if you come up and you do something wrong, that's where this in Europe. The, if you do something wrong and you like, oh, the EU like a million dollars, for example.
You can go, but you're gonna have to run through some hoops, but. If you could tell them a good story and it's true and all that the rest of it, you can prove it.
They'll cut it down. Because they know that there's Crazy initiatives. They're not for, you know, it's not designed for everybody.
They don't
Well, anyway, it's crazy. Hopefully, I don't think that's going to be like that here.
So I did find some information. By the CIA. I guess that's kind of why I was.
Mom, this is a so box. Where did I? Oh, here it is. No, that's not it.
Yeah, get rid of that.
That's interesting, but not that interesting.
God, this is the one. Okay. Are you guys familiar with CIA same?
That's cybersecurity and infrastructure security agency.
So they do have
And AI.
I think I went back to this because I wanted to show. What the CIA say is because I was wondering.
If you guys even knew about it.
But it's basically csa.com. Thank you, put AI at the end. So they've created this.
You know, a, a, a, a, mission of theirs.
This is what they would like the government to work on in the next so many years.
But you know I love these Grandios plans and they really don't understand how they actually do it.
But at least they're thinking about it, you know, but if it did
The only reason I like to look at this stuff is just to see it's more like validation.
And they have thought of these, they, you know. Looked at each other and created a bunch of meetings.
So that way they came up with all these ideas and stuff.
So the biggest problem that the CIA is trying to solve Is the critical infrastructure. They're actually in charge.
Of defending. Our water and Electric. All and all those things. You know, and they're getting attacked all the time.
And obviously, now we're talking nation states here the Prussians to Chinese, the Iranians.
Look, Koreans. They're all trying to get into our stuff.
So this is kind of what they're in charge of. I don't know if you know this, but If you want, you can get the CISA.
To to your company and they will help you for free.
I don't know exactly what that will entail, but That's what they tell you. I've met the several of their agents.
They're nice guys. I mean. Did that really like the FBI? They're more They can't, they don't have any teeth behind them.
They're just there for help. If they have the time, they'll come over and They'll give you help if you want.
But it is interesting the their topics in The things that I like to see. When I look at this kind of stuff Is what is their focus?
So they notice that they're talking about communicating.
Obviously, it's interesting this should be number one, but it's number 3. It's kinda funny.
This is the real reason that they're all around, but it's kind of funny.
And of course the training is that the number 5.
I thought that was just interesting as side notes.
The CIASA,
Probably has something to do with their funding. Bye, Chilling.
Well, it's they're part of Homeland Security.
Right. But even if that sometimes the way they present that stuff affects how they can get their budget approved.
Oh, there, okay. I see what you're saying, but then yes, that's a good point.
Yeah, that's what they think about when they're sitting around the table and trying to figure out what are we going to put on our website.
I'm sure Larry was like tons of meetings. That page. Probably a hundred meetings. Who knows?
So is the Yeah.
Anyway. See IS A, right? That's not My CIA say is a certification. Information Systems auditing.
That's why it's another reason I wanted to discuss it because it's like Unfortunately, they chose the same.
Words or letters. So if you go back to the 1st page.
At the very top, this is where you can see. Cybersecurity and Infrastructure Security Agency.
It's right on their logo.
It's they're all about defending the critical infrastructure.
They also like,
They have like 15 different I wonder where that is. I saw it before.
15 different sectors of the economy that they are focused on.
You know, like the, during, The pandemic. The essential workers. We're able to keep working.
That's what these guys are tasked to defend.
The essential.
I think they're here they're trying to teach the. Regular homes.
I don't know where that would be.
Anyway, I don't let's not do any research on those guys.
So, okay.
That's right.
But as a government agency, do they have a Are they currently making a big push towards defending AI? Defending against AI defending with it.
Okay.
No, they No, no, no, no, They made a website. That tells you what you should think about.
Okay.
I mean. That would mean that they would have to hire like . H.
Ds and stuff like that. They're not going to do that
That would be possibly like some of the universities.
Yeah.
They would have to fund the universities. Anyway, this is So I asked. What are some solutions or tools?
So I were having the same companies.
Here's where I got that Amazon Sage Maker. Splunk was I thought this was interesting It's Blank has a AI assistant.
And here is a tenable, the The company that makes
So they're gonna do something AI, which is good.
That's the, vulnerability. Assessments. I don't know if you guys familiar with that.
Here's the Cisco.
Yeah, of course, they're gonna they better be doing something as well just like Palo Alto is
There's Microsoft Security Compiler, they call it.
I think that's their chat GPT.
Version that they're selling. Somebody today talked about that. She has that on her. To see the see so had said that she was using security co-pilot.
To ask something but then she didn't like it. It was funny, but you know, it's because it's Microsoft.
Not as good as check the actual even though Microsoft owns chat GPT. Microsoft made its own software.
To be included with something or another. And of course it doesn't work yet.
Anyway. There was oh yeah, here's Upon Google's magic eyes open source, that's that was interesting.
Mean I'll look into this although it's it's for detecting malware
So you know you can go onto.
You can go and check to see if your file is malware.
Bye. I forgot that site now again, but. You can go online and Check if you if you have a file and you're worried about It's authenticity or whether it could be.
Malware, you can upload it. Of course, it's, you know, if it's something
Prietary, I wouldn't do that, but. You don't care if somebody else looks at your data or your That file.
Then they will, our virus total, that's right. Why I don't remember that Virus total is an is a website that will check.
Of whether you're the file that you uploaded is A virus or not. Now, So Google, Google's Magic is probably just a different way of doing this, except, you know, in Harvard, Google is doing it.
I have to. Do research on it. It's interesting that it's open source.
Yeah.
Hi, I'm actually kind of in unique. I always look like to look at the open source stuff.
I didn't, I didn't really have. A chance to at any time to do any deep dives on any of these things.
So I mean, I would be interested in finding a. But Zim, Moses like Splunk.
That is doing AI. I mean, I think there are a couple. Well, that's what they're claiming.
But again, remember Even if they're not that good yet. If there, if at least if they're saying to me If they're saying they have it and they're gonna work on it just like Palo Alto They've been saying that for a while and now in July they're coming out with something.
Of course, you know. Maybe it won't work right away, but that's okay. At least they've got something on the drawing board.
Something in this environment to me is better than nothing. A lot of companies are at the 0. They haven't even started their programs yet.
Sponks. Corporate history. I mean, I always look at them as a They were making their money on analyzing the, the logs, system log.
Yes, yes, yes.
Yeah, they
And, so it does look like a obvious spot where you could have an AI tool. That go through, read the massive amount of system logs that you might need.
Hey, the splunk is the obvious red hunting. Platform.
Yeah.
Cause it's kinda like looking at Wireshark. Millions of You know, files on Mars through Mars, Wires, and it just keeps on coming.
It never stops.
So,
Yeah, to me, look at this. So AI power, cyber suite, tool. So.
So this is. Like endpoints. So it's like an antivirus software or something like that.
You know, and so Okay, so this is also like an interesting. So I gave the information. The question and it spit this back at me.
So this is obviously what the the company so it's grabbed whatever Sentence had AI, I guess.
So. If somebody is. Even thinking of doing it maybe they haven't done it yet
At least they're they've got it under marketing. Stuff. Like this crowdstrike falcon thing.
Course this is a cloud company so they're also kind of
You know the cloud companies I think that they're huge targets for these future AI threats.
They they have to be building AI defenses If they're not, then they're useless kind of.
Anyway, what else? That I want to actually go over, I think. I think I picked on all my topics.
Yeah, I think that's. The other topics are
I had this one.
I think this was another set of questions and things.
Okay, I was maybe I was listing all these here
I think I did ask this question. Are there open source AI tools? This is what it spit back at.
I mean That necessary, I think. It also like focused on this. An open source. Not on the back.
Like maybe I could have asked. They're open source and AI or put put in question markers, whatever.
In quotations. I don't think it's answered. I doubt these all have AI.
So NBD fans this is kind of interesting. I haven't seen these guys before.
It's available on GitHub.
So I would have to check each one of these to make sure that if they are actually using AI. So these 2 are probably not.
They're just open source.
I mean, it's something to check into, I guess.
Time for another. Presentation I guess you know maybe next year
As always next year. Right, Gary.
But anyway, so I think that's all I've got unless you guys have questions or Really just a brief for all here And it's just an overview topic.
So if you notice, is there any? Any tool that is an AI powered. Tool which is looking specifically for AI.
Type attacks, the whole thing in your abstract about attacker and defender.
I don't think I asked that.
Okay.
You want to actually ask it that?
What are we asking AI tool for?
That specifically looks. Or an AI attacker.
I told to That looks or AI attacker.
Okay. Alright, so this is natural model, natural language model. Is there? Yeah, I too.
Okay. So,
Let's see, I can pull up the,
The CISA. Let's switch to you.com.
I mean, I don't have anything on here. That's just my last.
Qu, I guess. Let's go a research mode.
These are all my old and I just ask these. Anyway.
You will see it run.
Oh, I did. So I guess it wasn't that hard.
And these are all the places that it got it from.
I'm so I can see where you were pointing to.
These are all the links that it got the information from.
Oh, okay. Okay.
And they're actually down here too. They're like, they're like, But notes or whatever.
Okay.
This is I think this, you know, etc, etc. But you can see DDY, DDIY.
So, a secure is. There's a company. I'm familiar with those guys.
Sometimes it just, you know, it's not always great information that it comes back with.
That's funny. It's so they are tools but So maybe we need to give it more information.
Follow up.
I imagine at this point a lot of the tools are just marketing.
Yes, yes, well they're all going to be yes They're going to have to have some marketing.
Well, let's do thread hunting.
That's kind of been what i 1 of the things I asked that
Okay, did come up with something different than before.
Well, that's interesting. Open source tools. Board of Thread Hunting
So I'll put that into my file. I'm accumulating information here.
ABC Hunter.
Kuckoo's sandbox, malware analysis system.
These are probably for the sandboxes.
Intel.
That intelligence.
So.
Oh, lateral movement and thread hunting tool for Windows environment built on Django. It's Docker ready.
Well, this one would be interesting for me. Like to look into this guy.
Remote incident response.
Peach and catcher hold this Alright, well.
I don't know about this because away, okay. Detect fishing domains.
I would have to work with whatever email system you're working with. For it to be any use really.
But I wonder if it's I wonder what else, what else we could find about that. Find out about that.
I guess we just click on this.
Okay.
Cyborg.
Oh, it's from this company that's created 7 thread hunting tools. That everyone should be using.
So that's How they got it.
Bishing catcher here is.
Oh, that's good information here.
Sir Dreams Public API.
Certificate.
Like DNS, Twist, it's a classic.
Yeah.
A new plot.
Back to 86. This belongs into, Scott's a i mean, Scott's the presentation.
Yeah.
Attacker K.
Yeah. Right, in the right time frame.
Yelp of Exploits
Oh, so this is If you work like there at Pfizer we had A couple of guys, they were Pirate just do thread hunting 24 HA day.
I mean, they didn't do it 24 h, but That's all they did. So they could do whatever they wanted basically.
And they would just go all over the place. They wouldn't really come over to us. We never saw them.
We would call them if we needed to.
I mean, they would be using all kinds of different tools. To try to find stuff on the on the network.
I mean And you can imagine Pfizer. There's a lot of people that want to that don't like Pfizer for a ride for variety of reasons.
I don't think that's ever going to change for them.
I mean, malware and thread hunting tools are it's a very unique. That's why I picked that.
It's a little easier to. I think the more specific you are, the better you can get.
Information back from these things.
Otherwise, you're
Good morning. Good morning.
You're always going to get like generic marketing speak back.
Anyway. Okay. What else we got? You guys want to talk PCI?
Payment card industry stuff.
That's completely out of the scope of this meeting.
But this is an interesting, I mean, this is only like.
If you feed your,
Your AI, the PCI, PCI, 68 pages, even if you It's completely full.
It's really not that much data.
And you can do an easy search through it anyway.
I mean, we don't need AI for everything.
But it is interesting, I guess.
The new 4.0 is out by the way. If you guys are accepting credit cards
Gotta be a
Under the 4 point oh standard now
Which actually isn't that much different than the 3.1?
They they changed a lot of stuff for the the companies that make their own. Software. That accept their own.
Credit cards on their on their websites Or if you are a service provider. They've changed a lot of stuff for those guys.
For the standard, Merchants, they didn't really change that much for them.
Shyber Zebachev
Well, that's secretive agency known as GCHQ.
Okay.
Okay, there you go. So this Back to the hackers use this in those, at Devcon.
Is there constantly? In those, different, capture the flag scenarios. You're always having to like decode these.
Different methods. You better know how to use Cyberchef, I guess.
I wonder if you can find. What the XOR in base 64 is if you can see If you're looking at data.
And. You notice that it is. Oh, there you go.
Oh, so this is There are 2 basic support from base 64. That's kind of a cool little tool.
And you can also, Encrypting code.
One of the. Challenges in binding the malware and the attacks. Is that stuff is encrypted now?
No crazy,
So I don't know if you know this but my My soccer team in Germany became German.
They won the the won the league
So that's I think that's how we can end on this.
That's great.
Really?
Devx of They the 1st time they've ever wanted.
Hey!
So it was it was in it was amazing. And they're like, The nickname is back self.
That's the working elf.
And they're actually interestingly enough, their bear. And I used to live when I was a kid.
In the right near Cologne. And now I'm. I said I'm right near a river here.
Yeah.
And Bayer bought the company that It's around here. So I'm like, what that's weird.
Oh
What what a what a circumstance.
They're following you.
I know exactly. Anyway. Alright, what else what else should we discuss here? What do you want to go?
You want to ask any more questions to the you.com dude.
While people are thinking of their questions, I like your, your comment there a moment ago where you said, They actually encrypted the attack and that was one of the things.
And Shawn's presentation about, the, Exe utility, back door.
Is he did a wonderful, wonderfully complex. Presentation there but one of the things that they did to sneak the back door in is the stuff that made up the back door.
Yes.
Was encrypted. So when you downloaded the files, Wasn't evident that there was.
They're makings of a back door there and it was subsequent things that got downloaded and run.
That wound up unencrypting it, getting it ready to run. It's very complex attack.
Oh, interestingly enough, I did want to mention to this to you guys and probably doesn't matter for you but
I don't know if you know this, but
North Korea
Has there, Soldiers that our computer savvy.
So what they what they're doing is they're going all over the world Looking for remote jobs.
And applying to them.
We had the FBI guy mentioned this at the last data connectors.
It's interesting. So what they do is they don't even directly connects to the company.
They hire somebody that directly connect, that talks to their company.
So through a proxy. So that way you can't know exactly who this is.
So there is a you have to if you're hiring remote workers You better be getting like some kind of verification.
Of their.
Went up there a driver's license or more than just the standard verification.
Like. You know, I'm I'm with our organization that is run by the FBI the their data card or Anyway, those guys.
They made me. Do IDs, IDs secure or whatever. There this one app.
That they double checked. Who you actually are. That's the kind of thing you have to do because The North Koreans are trying to infiltrate everywhere.
It's kind of interesting. Obviously.
The more, let's say you're part of a electric company and you've got a remote worker.
Well, the North Koreans are very interested in working for you.
Oh, well.
I'm sure they're like not very good employees, but you know, they might be minimal employees, but That's kind of irrelevant.
They just wanna. Get the email stream and all the rest of it.
I don't know. I don't know exactly how they attack you. He didn't really go into some of the details because I'm sure he didn't want to and I I don't think nobody wanted to ask that question.
This is the old, the Lazarus.
I think that's a group that they've, they've, the Lazarus group, yeah.
Yeah.
I don't know if you guys remember the 2,014 Sony Pictures attack. That's who did that.
They also like, Stole some money from this this bank
I was, I was asking this question for. Wanted to see what it answered with the, and obviously that's an easy one, cause it's This is all old information.
The These What do you call it? The large language model. Interfaces. Very good at old information.
Anyway. I think, we're almost at 9 here or we are at night.
Yup, you are.
Very good. I think I think that's good.
Any questions for Tony?
Sure.
I got a follow on question. You mentioned something about Zoom being linked to China, but all the Earls that I'm seeing in.
The traffic is zoom.us, which is out of Palo Alto.
Yes, but is Zoom that us
Computers.
Computer information.
Would be a shell company.
Paste. Yeah, good.
They are using
Well, this is so they're going to only find What they what Zoom has allowed them to say.
Yeah, right. That's what it says. That's funny. This is from times of India.
But that's pretty much.
So unfortunately, so. There was somebody. Okay, we gotta get out of here. Let's go to Doctor Go.
Yeah, it's a bunch of junk.
Anyway. So, let's see.
Zoom. Origin.
Systems.
Yes.
Well, for, for example, the zoom.us base IP. Is hosted Amazon.
And the mail is handled by PP hosted.com which is also Amazon.
Wow, for the here they're talking about the Zoom vulnerabilities, which is a completely different issue.
Right.
Hi, that's okay. I, I just thought you might have, some reference or citations you'd seen that were
Yeah, there's a guy I I forgot his name. One of the, you know, all these hackers have their like, given or like nicknames or whatever.
And.
But I don't remember it quickly here. Forget it. I could get back to you if you do.
If I, it's not I'm not gonna spend too much time at it.
Oh, and for your information, the reason we're on Zoom is because we need assistive services.
Yes, I'm
We've not been able, we've never been able to get them running on.
Right. Yeah, the I'm sure it's because you you can record it.
Right. Well, that's a that's another issue I guess so I'll I'll have to remember and you know whenever I look into whenever I read that I'll look into it.
I'm not gonna specifically spend time at it.
Yeah, yeah, if you run across it, it'd be, Interesting. If you get me post the link to discuss or something.
Okay, okay, thanks.
Yeah, yeah, okay, that's fine. Alright, thanks. See you guys. Thanks for the
Alright.
Hey, thank you very much, Tony. As always, it, it's been a pleasure.
Yes Let's see.
Good info. Yeah, like the discussions.
Anybody have any just general questions QA, stuff that not necessarily, specifically aimed at AI or.
Our cybersecurity.
Gary, this is Stan. I think you should do a book end and then people could continue on beyond.
To closing out the recording.
Well, okay, we're good 1st to see if anybody wants wants to get something on the recording is it?
Okay.
I was gonna ask one question. Kind of security related. Passwords.
How long should they be to be secure? We switched to pass phrases last year that went up to 20 characters from Previously, we were at 12, K.
So.
Is that? Sufficient normally for AI attacks.
I mean, the thing is.
What I personally, what I do is I have 2 or 3 different methods.
So when I, go on a website that, Isn't really that important? I don't know if I give you an example, but Just I'm just checking.
Whatever you know stop for the for for Food, food related things or whatever it is. Doesn't have any of my information on it I don't even care.
I put like 8 digits and I just something that I remember.
I don't even bother putting it into my password manager. Because it's just not worth it for me.
It's just you know just silly but then I have like the middle ones.
Where you know I guess I would I don't really want somebody easily to grab rabbits Then I put at least 1516 digits.
And I have a couple of different methods. I usually Write them down in my little book and then I also put them in my password manager.
Cause just in case. It's like an extra protection. Of course, you know. Basically that book.
Has to treated just like your Money, you know. You can't just give it to anybody.
You can't let people walk in. See the book and all that jazz.
So then the if you're like. Depending your access to your your bank for example.
I don't remember what how many digits I have on that. The more digits, the better and I let the That's what manager.
Manage that. And you know, but. I don't think it If you have a quantum computer, it doesn't matter how long it is.
But if with these days, and it depends on how much processing power they're going to throw at it as far as brute force attacks.
I mean, they're gonna have to be sophisticated. You basically
Are, are you looking at defending yourself against a sophisticated attacker? Like a nation-state, forget it.
Don't, it doesn't matter how long you make it.
Okay.
So that's why I don't worry about it that much as long as it's at least.
20 something digits You're probably okay, I mean.
Are you are you a diplomat from Malaysia and you want to make sure you're not going to be hacked?
You're kind of screwed. If you if you ask me But if you're if let's say or this is actually more common.
Let's say you got lucky with Bitcoin. And you have a couple 1 million dollars of Bitcoin.
Which is the possibility, you know, people have had that. But they're not really that savvy.
And unfortunately, you lost your key.
You can't ask the question online. And someone help me with my key. I mean, yours You're gonna lose all your Bitcoin.
You gotta be smart about this stuff.
I think as far as the The length of the The password is Are you are you keeping track of it yourself or are you?
You know, having the password manager handle it. Those are more important. Then, you know, are you gonna be at 24 digits?
It's more than likely. You're gonna have to get it or you know you're gonna do something else that is Let's say I'm insecure.
As far as the over time. You know, they say that the number one. Help desk.
Request is about the password.
I think we are going to eventually be losing all the passwords. They're working on it.
The next few years. We're not gonna have any more passwords.
Well, Bit Warden is, is jumping on the pass key bandwagon.
Yeah, yeah, we're gonna have
So what I would do if I were you is do MFA. That's better than having 34 digit password.
Why are you 75 all the time, random pair?
I know, yeah, I know. 75 is or nothing.
Well, but the problem is so many. Big websites will only take 18 character passwords like I know.
Oh.
I know that's right. See, so you You can't even use You're 25 digits anyway.
At least you're not on a website that only uses the 8. That would be ridiculous.
Yeah, really. Yeah, it blows me away the PayPal won't I think it's like 18 or 19 character that's it
Oh, actually, I actually disconnected myself from PayPal.
Yeah.
They asked me for my, driver's license. And I said, I don't want to give that to you.
Well, you have to have to federal regulation. They have to be able to do document a beneficial owner.
Otherwise, they can't.
Well, but, no, I don't. I don't have to use it.
Okay.
That's what the Fed say you have to have positive ID.
Well, okay, but I'm not using it. So therefore I'm not going to use
No, absolutely.
Somebody that Ask me for my driver's license. I'm just gonna go use my I'm gonna use my bank.
My bank is
So you're, to give out credit cards all over the place instead of using PayPal.
Yeah, well, that's credit cards. I have a mechanism of A fraud.
Well, but if you don't use PayPal, it means you have to give your actual credit card number out to everybody.
Instead of going through PayPal where nobody gets your credit card number.
You know, PayPal has too many, Tax on them as it is. I just disconnected myself completely from PayPal.
That's cause I started to, you know, I know I realize what you're saying, but I didn't like that.
I know what the kind of things that they They've had problems with, you know, I look at their all their vulnerabilities and stuff.
So it's, you know, I'm not. I'm not all that high on their security.
Anyway. I wasn't really using them all that much, so it doesn't really matter to me.
And now they have competition. Tenmo and all the rest of it. So.
Yeah, but they're all app apps or to me, totally insecure compared to PayPal.
I mean that's worse.
PayPal has its own app.
Yeah, I don't I don't like Whatever. I mean, 2 weeks is on.
It's no big deal.
Yeah, and that's I think that's it's just a matter of. A little bit of you know personal preference
Alrighty.
Anyway, all right, very good. Okay, I gotta get back to other things. So thanks for the
Doing a little bit of research and showing you my research. I guess.
Thank you.
Hey, thank you much, Tony. I really appreciate it. Thanks a lot.
Alright, you welcome. We'll see you. Until next time.
Thank you, Tony.
Anybody have any? Any other, general QA questions they want to throw out real quick?
This is Stan. I wanted to tell, Joe B that is best of mind knowledge.
The Department of Defense. Requirement now is for 20 character password. And we recommended. And.
Okay.
A number of years ago it was 15. They've gone up to 20. If you want.
Grc.com. Steve Gibson's site. He has.
Yeah, a procedure.
Okay. I'm, I'm, for Capitol log yard. Hey, we're actually going.
To help. grc.com has has a page where you can go in and test.
Is that, minimum or maximum?
The viability of the password that you're creating. And it and Whatever you put in there, it'll take it.
Okay.
And how long it's good for. Gives you, an estimate of how many years it would take to crack it.
At grc.com.
Hi, recently got my letter from AT and T said that my account had been breached. So I followed the Steve Gibson advice and went and and froze all my credit at all 3 agencies
What's the website again? prc.com is not.
Is the prc.com or
What? Well, we're on theo Charlie.
Golf Romeo, Charlie. Thank you.
And
It took me to spin right.
It's been right.
Well, on his page, he's got a page on there for testing out your password streak.
Okay, cool.
You're ready. Any other? Questions topics points.
Okay, go and do a book end. Okay, coming up on the book end, 1st just reminding you all next Thursday is Scott Graneman he'll be talking about the history of the history of computing since 1,980.
Kind of a follow on the talk to get, what, 2 months ago, the history of computing since 1968.
And we stopped right around 1979. So that's next Thursday and then next next month, the general meeting on Wednesday.
Will be the second part of the series from Lee and Grant on sniffing. And the main presentation will again be Scott Graneman and it will be social media for techies what we techies as users of social media have to know about which social media platforms are appropriate for us.
And why? So with that, thank you all for coming. This was the general Slug, St.
Louis, Linux, user group meeting. General meeting for May today's date is Wednesday May the 8th 2024 And thank you all for coming.
Good nightThank you