Name: CTI Summer SLAM
Uploaded: 2026-07-29T18:30:58.005Z
Duration: 2 h 9 min 40 s
Description: CTI Summer SLAM

Transcript for "CTI Summer SLAM": That hurt. Okay. I guess we're live. So, oop, let me put on my can't put on my virtual background. Hello, everybody. Virtual background error. That's great. Alright. Well, welcome to the, CTI SummerSlam, everybody. We are very happy to have you all here with us today. And, before we get started, I just wanted to run through a couple quick housekeeping items. This session is being recorded. A copy of the recording will be shared via Discord and, via email. I'm gonna continue to try to get my virtual background to go up while I talk, so bear with me. But it's not looking good. I'll probably just leave and come back. So, yeah, welcoming everybody, and so glad you're here. Before we start, just wanna give a quick shout out to the team here. You've probably seen some of these folks on the big stage at RSA, Defcon, BlackHat, Identiverse, or, through maybe our relationships with some of the various ISACs. So major shout out to Andrean, Estelle, Tammy, Olivier, Adrian, Chris, Asaf, Oleg, you're here with us in spirit, and the rest of the team that's out there, fighting the good fight. Thank you guys for everything that you do. So we've got a stacked lineup today, a lot of ground to cover. Dylan, let's head down to Jerry on the court. Hey. What's up, everybody? Welcome to CTI SummerSlam. I'm super pumped, Joe. Thanks for the introduction, and that drone was excellent. Everybody, for the next two hours, as far as I can tell, the net is up. The stripes are on. As you can see, I'm cut out a little bit, and I think it's because my boom arm, but trust me, I'm fully here in person. We are gonna be bringing some of the sharpest minds and threat intelligence onto the court to serve rally and settle a few scores. Stay tuned for that a little bit later in the show. For those who don't know me, my name is Jerry. I'm with Simply Cyber Firesides, hashtag team SC to the crew in chat, and I'll be calling the match alongside Joe in the booth today. And we've got debates, Fireside, CyberCram panel, solo ace talks, all queued up. Joe, which one are you looking forward to most, dude? I think there's a talk on, Chris is gonna give later on the Chinese Telegram marketplaces. I guess they've been up to some some stuff that Chris is gonna to dive into. But, Jerry, I just wanted to say, one thing. If if this community isn't already following you in Simply Cyber, I would highly. encourage you all to do so. Jerry is one of the guiding lights in this community. He's dedicated to education, to information sharing. And, Jerry, your goal is Simply Cyber. They align perfectly with ours at Flare. We believe that everyone deserves to be safe online, and you help make that a reality Oh, thank you very every day. So thanks, Jerry. We got the teams warmed up. much. The net's up. Let's, let's get the party started. Oh, I love it. Absolutely. And thank you for those kind words, Joe. I do really, enjoy flare and and all the work that you guys are doing. So guys, listen. Every match needs a first serve, and ours is a wicked strong one. We're gonna be bringing on Asaf. He's a threat intelligence researcher who's been deep. When I'm talking deep, I mean, like, underwater looking up through the bubbles, deep in the world of World Cup fraud. And before we get to the debates, they're gonna walk us through the scams, riding the coattails of the biggest tournament on Earth. Asaf, the court is yours. Thank you so much. So I'm super excited to be here today. Let me share my screen real quick. I prepared the deck for you. Let's see. Oh, okay. So first of all, I thought, what would be a good segue to, for this event. So I thought maybe to present HUMINT, which is, threat intelligence technique that is not, well spoken or it's not in the front seat of, threat intelligence and also to connect it to, the FIFA World Cup, which just ended and to show how attackers are, basically doing in the under normal or our scammers. So first question is, what is human? And it's basically to go, to hackers, to scammers, to everyone, and to be real nice and to say I'm stupid. Please teach me and then to be a little bit vicious about it. This is basically for me, human. And the second question is, what can you do with human? So I have two quick examples and then the FIFA. So this is the banner of the Philippine National Police. And about ten years ago, I was asked by the Philippine Police to help them with a hacker that they couldn't, track. He basically built some fishing kits against their major banks. So I befriended with him on Facebook, and we were, really good friends for a while. Even got me access to his, SMS infrastructure. And then I sort of explored this SMS, infrastructure, found some vulnerabilities, and, disclosed to the Philippine police his entire crew, suppliers, vendors, and everything. And this was only possible, through a human speaking with him, befriended him, with his girlfriend, and basically trying to see what we can do and how we can gain some threat intelligence. Another example is Headcrab. You can read all about it, which is basically a very sophisticated attacker of this. So I also I wrote him an email, and we started talking. And then he sent me some samples of his malware, how to decipher it, how to analyze it, what he's doing, and he was very helpful, saving me a lot of time, doing reverse engineering. So these are kind of, some examples. So let's talk about, football or soccer. It depends which side on the map you are. So, football is basically, one of the most popular sports around the world, even when compared to other sport, like, baseball, football, cricket, hockey, whatever. And you can see that the, top, sportsmen even earn much more money than others. And okay. And when you think about the FIFA World Cup, so this FIFA World Cup was especially important because they increased the number of teams from 48 to 32, and, it was the last FIFA World Cup of Messi or Ronaldo. No matter if you are a fan of Messi or Ronaldo, you wanted to see them. You wanted to hear the excitement. And when you wanted to buy a ticket, you only had one ticket one, vendor, which is was the FIFA World Cup, official vendor. But then all the tickets ran out. They actually tried it on purpose to, increase the demand. And then when you can find whatever you want online, all hell broke loose. So now a secondary market appeared, mainly on Facebook and social media. So let's buy some tickets. That's what I thought, and I approached the hackers. So one thing that I noticed when I got into the groups and published that I'm looking for tickets, all the hackers said, yes. I got four to anything. So have you got tickets to this match? Yes. I got four. Have you got tickets to that match? Yes. I got four. All that. I I don't know why, but this was a pretty easy way to spot hackers or to spot scammers. And then when you go to their social media profiles, you can see, I did this research, late April. You can see that they created their profiles towards, the end of April. So all their profiles were new. So how do you approach scammers with humans? What do you say? So, obviously, it's you have tickets like the Shakespearean English, and the answer to that is pretty simple. If you are a known scammer, they will say, yes. Of course. We have this and that tickets. They will be, specific. They will say, we don't have, tickets to matches that don't exist, or we don't have met tickets to matches that ran out. So these are the non scammers. But when you think about the scammers, you can see how many scam they they basically ask how many scam how many tickets are you after even though I didn't mention which, match I'm looking for. And, basically, they say, yes. We got everything from everything, and we'll sell it for you, because the tickets don't exist. So then I started playing with them. So I asked, can I see can I get the tickets to the match between Uruguay and Jordan? The problem is, Uruguay don't play doesn't play with Jordan. They're on different, groups, and they're not supposed to play until the final. So and none of them will reach the final or have reached the final. The second question I had, can I see the match between Russia and Italy? And they said, of course, you can. So Italy didn't qualify. The it's the third World Cup they didn't qualify. And, Russia had been banned from a competitive sport for the past six years, I think. So they also didn't qualify to the World Cup. But when I asked to see a proof, yes, of course, you can see whatever you want. Even tickets between Belgium and Italy even though, they they they didn't play and Italy didn't qualify. And then I asked, okay. Can I see a ticket between Germany and Velo Moron? I even invented a country. Yes. Of course, you can. And I don't know where you can find it. When I invented it, I thought it's in Eastern Europe. And lastly, I, actually found a scammer who taught me a little bit about the entire, the entire, orchestration, the entire group. Well, basically, he told me that they spoke about me, and they think that I'm a scammer who try or who is trying to scam them. And, this, person even named some people and named some Facebook profiles, and she even tried to convince me with another scam, of course, to join this, fraud ring. All I needed to pay was $5,000 to get in and another thousand dollars to get my badge. So thank you very much. I hope that you enjoyed this talk. You can read all about it, on Flare. You can scan, the QR codes. Awesome. That was fun. Joe, are you gonna get tickets to Cameroon versus Latveria? You're on mute, Joe. I I wonder if I could afford it, Jerry, but even the fake tickets are out of my price range. Yeah. I I love it. I love, I mean, that's such a such a savvy way to approach it, like asking for tickets to an event that doesn't exist, confirming essentially, you know, that it was a fraud. I I will tell you that, based on what I saw online and in the the news, like, the ticket prices that they were actually trying to charge was probably on brand was what FIFA was charging. I don't know if you saw the price of those tickets. They were, like, outrageous. So the scammers weren't even trying to, like, cash in on it. They were just trying to I mean, I guess it's a 100% profit, though. Right? Yeah. I mean, I feel I feel bad. I just think about the people who bought tickets to take, like, their kids to the game for, like, the first time, and then, like, the biggest fan of whoever. And then sorry. Yeah. We're not gonna get. able But one of the things before we get in the next segment, one of the things that is. seems, like, really popular right now is, like, the the watch parties outside the stadium or the watch parties. Did you see, like, the Norwegians? It's, like, 2AM in the morning. There's, like, thousands of them just partying in the dark. No. No. But I did see the Scotts just having a a absolute day, like, taking over the whole city of Boston. Oh, That. was nice. took over Boston. Actually, I think Boston's invited. them. Yeah. Like, even even if there isn't a an event, like, we just want the Scotts to come over. Again, for those who don't know, Joe and I are both from the Boston area. So little, little shout out to the the hometown that's hence the Larry Bird love, in the background. Yeah. We drink a lot of Dunkin' Donuts. yeah. Oh, dunks. Dunks. Dude, so, Joe, SF's open was awesome. And, honestly, in my opinion, it was a perfect setup. You know, guys, it all starts with creds, and credentials bring us to the first debate. Now this is face off at the net, and this is super cool. This is a really innovative approach, a new kind of piece of content that we don't normally see in our cybersecurity circles. Okay? Our first debate is gonna be about password managers. Should we actually be using them? What do you think in chat? Just quick quick answers and checks. We're gonna get some real experts dropping knowledge bombs on this. But do you think we should be using password managers? Should we tell our nontechnical friends and families to use password managers? On one side of the net, we're gonna have Andrean and Estelle. And on the other side, Chris and Oliver. I'm refereeing this one, so I'll post the provocations and let them rally, Maybe throw out some whistles and yellow cards even though I know that is not a volleyball thing. And to the skeptics, one breach and it's a master key to everything. Isn't it? Right? And to the believers, what's the real alternative for a non tech user? Guys, I'm excited. I'll let Dylan kinda set the the the terms and rules of this, but I'm gonna sit back over on the sidelines, crack open the, the Yeti, and grab a cool refreshing drink while we watch this. Alright. Let's do it. Hello, folks. Can you hear me say it in the chat, please, right now? Yes, sir. Alright, folks. As I've been introduced by Jerry, my name is Dylan, and I will be your debate host for the day. I'm gonna give you guys a quick rundown on the rules of how this debate is going to look. And, hopefully, by the time we all get started, we know exactly how we're going to rumble. So for those of you who have never sat down in a proper competitive debate before, here's how it's going to work today. There's gonna be two teams, one motion, and no one gets a say on the fence. Proposition side fights for the motion, opposition fights against. So you'll see one side advocating for password managers and another side absolutely destroy it. Each side will take turns making their case during the opening speeches, hitting us with their strongest constructive arguments. Then the gloves come off, and during the cross fire, there is a rapid fire cross examining period lasting fifteen seconds a pop to take their best shot. Then the second speakers come on, and they rip and tear into each other's arguments during the reputation speeches. We have another crossfire, and the debate finally ends with a grand crossfire, a free for all where all four researchers go head to head in a final battle to decide who wins. And at the very end, when all of the dust settles, it's you, the audience, who will play judge, jury, and executioner. It will be your vote in a poll of public opinion that ultimately decides who wins or loses this epic debate. Rules should also be posted in chat. And if it's all a little confusing, don't worry. I'll make sure to flag every step along the way. As Jerry mentioned, this mouse motion will be on should we be using password managers. But before back, what does the audience think? Let's check the poll results. And if we look at that, we have an overwhelming support for password managers. It's gonna be an uphill battle for opposition. Will they manage to swing the other side, or will they finally be beaten by proposition's status quo? Let's invite up the debaters onto the stage, and let's get started. Here. Here. Hello. Hello, debaters. Welcome to the stage. You are online. Are you, ladies and gentlemen, ready? I was born ready. Yes. So, Chris, Then go first. further ado as the team who is four, I think you go first, and then it's gonna be Estelle for their rebuttal. It will. Alright, folks. Let's do this. So I would like to invite up the first proposition speaker to make their case towards password managers. This speech will be three minutes and not a second longer. They will be cut off past that moment. The speech will be timed the moment they begin speaking. So without further ado, hear hear, folks. Alright. I have three simple arguments. Firstly, they let you use strong passwords without having to remember them. The biggest problem with, with passwords is credential stuffing. The the fact that you reuse the same password over and over again because it's easy to remember one password. Somebody one of your accounts gets hacked, then somebody can just try that same password in other places, and now you're hacked in multiple different places. Password managers let you just store passwords. You don't have to remember them. It's an ease of use thing. Secondly, they prevent you from having to type in your passwords manually. Again, sort of goes in with the first scenario. You're not typing in your passwords to Facebook or whatever or Myspace, if you're fifteen years ago. You use the password manager, and it knows what websites you are on. If you're on a phishing website that is not the real Facebook or not the real Myspace, it's not going to autofill your password. So you can trust the password manager to autofill your password in the right place, preventing you from just typing in your password anywhere. So the big one for me, though, is that all of the realistic alternatives are just worse. You can't name me one alternative that is better. It is the only real option. You can put your passwords in a browser password manager where an Infostealer will get them. Everybody Infostealer developers know how to get all your browser passwords. I look at people's browser passwords all day at work. Having some kind of flat file on your computer unencrypted, that is terrible. Having some kind of flat file encrypted on your computer, where are you keeping your private key? Manually entering passwords by hand, which obviously encourages password reuse. You're not gonna remember them. You're gonna it's just a mess. You could also store them somewhere physical like a notebook. People love thinking this is a great idea. No. You're somebody's gonna get robbed. Your your your your kids are gonna find it and bring it to school for show and tell. There is no reason to do any of these. Just use a password manager. It is an ease of use thing. It is a it is just simply better than any of the alternatives. Am I at three minutes left? Do I have time left, or can I drop my mic? You have fifty five seconds on the board. Would you like to keep speaking? Fifty five seconds. Okay. I think that the the first two that I mentioned, the using high entropy passwords that don't that aren't reused and defending against phishing go hand in hand. The without the use of a password manager, that sort of off password managers offload the cognitive work of having to remember and type in passwords. So these two go hand in hand. You don't you shouldn't have to know what your password is. You shouldn't even have any idea what your password is. So, this is the reason why password managers are just better than any conceivable alternative. Ub keys or whatever, these physical keys. No. This is nobody's gonna use that. Sorry. What a buzzer beater. You just closed off your speech with five seconds on the clock. Congratulations, Chris. I would like to thank the opposition speaker for their time and would now like to invite up the opposition speaker in order to present their side of the case. Same rules, three minutes and not one second over. Time starts when you begin. Here. Here. Yep. That's me. We argue that mass adoption of password managers is not the solution to security is sold as if and as long as security knowledge, is not raised with it. Because without security knowledge, people just don't know or don't care about their security. They don't know what the threat is. They don't know what danger is outside of this when their account is not secured. And with this comes the lack of trust towards the technology that is the password manager, which can be complex, not so user friendly. So people think it's not even useful, it's not effective, And then sometimes it's even paid for. It's not even free. We have arguments of people thinking it's really to protect the password when the password is told as being the protection itself. So where would you protect the protection? This leads to a low adoption rate in The United States. About 65% of Americans do not use a password manager, and that percentage goes up with the older generations. But, okay, some people do use them. I will con I will concede that. But even when you use them, it can have some harm in it because if you don't use them with the proper security knowledge, then it can go bad. Let me give you three examples. The first one where some people just, set up the master key to the vault with a simple password because they wanna remember it. So they pick a password they already used when another comes so they can remember it. But then this password has been leaked or cracked, and then you're locked out of all of your accounts and it's compromised. Second scenario is someone that's very diligent in the master password, so they use a unique and complex password. Perfect. But then during the next month or two, they forget that password, and, again, they are locked out of all of their accounts on the vaults. Lastly, even if you're diligent with the master password, then you can even have bad practices. If you autofill your passwords or save them on the Google browser, even if you have a password manager, they're gonna get vulnerable to malware. All these scenarios just to show you that password managers could be the best tool of the world, but a tool is only as good as the human behind it. And if the tool needs security knowledge to be used and to not be harmful, then maybe that might not be the best tool to use for the security problem. Alright. And I believe that closes off the first round of speeches, which means you know what comes next, folks. It's going to be a crossfire. Now to explain again, each side will get a chance to ask each other a fifteen second no longer question to one another, and the other side has the right to respond. They do not have to respond, and some of these questions can be really pointed. Let's see what our first speakers have cooked up. Proposition gets to go first as is tradition. Whenever you're ready, the timer starts, and we'll count down from three minutes until this crossfire is over. After that, do what you want. So, this is me. Yes. Olivia. Okay. So I guess my biggest question is a lot of these things, would you classify them as usability issues rather than cybersecurity issues? And is that is that more important? Is usability more important than security? Or, how do you think that usability and security are are are interconnected? I think they are both interconnected, and especially when security is dependent on usability, then we have a problem. If you don't put your seat belt, then the seat belt can protect you. And that's essentially what's being asked with the password manager is to create the seat belts. Estelle, it's your turn to cross examine Chris. Yes. You talk about offload, cognitive to don't remember all the passwords. For some people, it's just hard to remember the master key and even remember the backup codes, And so they forget what's the solution here for those that are not really strong about that. Yeah. Absolutely. I mean, I I think biometric is a pretty strong there's a pretty strong argument for biometric. You know, I I use face ID. I know people have other reservations about face ID, but I think that's very, very good. Yeah. I would say biometric a, biometric b as a backup, that is I use that on a daily basis, and I think it's great. Chris, the onus is on you. So would you concede that the usability issue I'm sorry. Not the usability. The security issues with, with password managers being sort of, you know once they're decrypted in the browser, they may be in memory for the duration that they're in decrypted. Would you concede that maybe a sensitive a a sensible default for, you know, re encrypting these passwords, would that ease those, issues, or would it still be overwritten by the usability issues that you, that you mentioned? I would say if the better awareness is not, in line, then we should definitely aim for a better default. I will come back to the seat belt, but the seat belt has been engineered so that your ignorance is cannot deminuate the effects of it. Like, a four year old can click a seat belt. So if we manage to do that with the password manager, then I think it's going to be great. So would you like to do one more crossfire, or wouldn't or Or do would we like to close the round for now? I think I have one last one. You talk about browsing, browser extensions that could ease the use of them, but we now know that browser extensions of password manager can be vulnerable to malware. So here, the ease of usability is being weaponized. So what's what's what's the response here if we have any? Yeah. Certainly. Well, I mean, I think that this is a broader problem with software in general. I think that that trust this is a trust issue with all software, not unique to password managers. Alright. And that's the close of the first crossfire. Please give a round of applause to our first speakers and for constructive arguments. Now let's get to the ripping and tearing for the reputation speeches. I would like to invite up the second proposition speaker to come up and destroy the previous opposition speaker's point. Here, here, same rules. Alright. That's my cue. Okay. I wanna start with something really important that will completely shatter all arguments so far. To some extent, a notebook with password written on it using a a pen is a password manager, which means it's invulnerable to, malware attacks. So I wanted to get this out there. And why? It's because it you use it to manage passwords. Right? And this is the most usable thing I recommend my parents to do. Right? The threat is online. The threat is not your neighbor. It's not someone who steal your house because it goes after something valuable, not passwords. So this is why this is a very good, and usable approach. Next up, I want to reiterate the fact that you should never use, passwords. And so, by, having a password manager, a software password manager, you will, be resistant to any breach. We know now that hackers are going after organizations, and they wanna make money. So ransomware attacks, extortion is the are the big threats, not necessarily individuals themselves. So if you don't reuse any password, you are then resistant to the things that are attacked the most nowadays. There is I wanna reiterate the point that there is no realistic alternative to password managers. Like, nothing right now. Pass keys are stored in a password manager. Right? The the face ID, your biometrics are basically, again, software used to store some sort of credentials that identify you. So this is these are all under the umbrella of password managers, and nothing is there's no breakthrough here, except maybe something that I would not say here. I'm not gonna give you arguments. Okay. I wanna also touch on the layered, security opportunity. Okay? You can have your, less critical password stored in your browser password manager for convenience. This is almost what everyone does. I know because I read stealer logs for a living, and I see the amount of people relying on that browser password managers. They're they are susceptible to attack. Yes. So this is why you should layer your security by having, for people, like, in IT IT or people with, that have secrets to protect, you layer them with another software or cloud based password manager, and you can also layer with a local password manager like KeePass or something open source. So to me, this is just PasswordMan Whoops. Looks like someone ran out of time. Better watch the clock, folks. It's important in the debate. But Olivier brought out some wonderful refutations. I would now like to invite up the the second opposition speaker to go on and rip apart the proposition arguments and maybe do a little bit of rebuilding of their side. Here. Here. Hello. So I'll start my argument by saying that in 2022, Acura's Breach LastPass, one of the most trusted password manager on the planet. And they didn't walk away with, like, one password. They walk away with the, encrypted vault of million of users. Every password, those people own in one text. They were encrypted. Yes. For sure. But it can be cracked also. So that's the core problem with password manager. They don't eliminate risk. They concentrate it. Instead of a 100 separate locks on a 100 separate doors, you now have one master key to open every doors in the build in the building. So crack that one key, and then you're screwed. And it doesn't just work in the attacker's favor, it also work against you. So, as mentioned in my Estelle earlier, forget your, your master password or lose access, like, to your physical device in which it was stored. And and and then it's gone instantly because of one string of character that you have to remember perfectly forever and with no one able to recover it for you. So the other problem with, Password Manager is that there's a lot of friction. It's not user friendly unless you pay, and people unlock their vault on average, like, 20, three times a day at thirty second each because their password master password is very long. So that's approximately ten minutes every single day just retrieving credentials. That's a lot of friction. And don't tell me to leave it open, Olivier, because an open vault is like having no vault at all. And here's what nobody likes to admit to. You will need you will still need MFA. But to cut down on that friction, people store their TOTP codes inside the same vault as their password. So think about it for a second. Your entire point the entire point of, of MFA is having two independent factor. And the moment you store the second factor, next right to the first one, behind your one master password, you don't have two factors anymore. So you only have one point of failure. So maybe the answer is, you know, convenient password version of password manager, the one built into your browser. It auto fills, it's free, it's already there, but convenience here is a trapdoor. Estelle mentioned it very quickly, but every credential in that browser vault can be stolen in a single cross site scripting scripting attack, or with InfoCeeter malware that are built built exactly for this. This is one of the fastest growing category of cybercrime. So the more convenient the vault and the more attractive it is to target it. So look at what we actually have, a tool that concentrate risk in its instead of risk in reducing it. Sorry. A tool that can lock you out of your entire digital life because you forgot one string of character, and a tool that add daily friction no one wants in the first place. So that's not a security solution. That's a dangerous, incomplete one, and pretending otherwise is the real risk. Perfectly on time. My phone's still vibrating. Congratulations on finishing the constructive parts of this debate, debaters. This is where all the valuable information will go. So now onto the crossfires where you get to beat each other with questions. I'd like to invite the previous speakers back up. And, of course, proposition starts with their first cross examination question. Three minutes. Let's go. Okay. In what world can you forget your master password? Okay? You write it down. As we said, the threats are online. It's perfectly acceptable to write down your master password. Please respond to that. You know, if you bring everything back into, the physical world, so, like, having, your password written on a paper, then you are agreeing that password manager are useless because, like, you call it password manager, but this is a stretch, Ivy. Like, if you just go back, put every everything go back to Physic, you're just, like, canceling your argument. Is, it my turn to your turn. so, I had one, but I'll I'll switch. So, yeah, my question is, don't you think that your point of view is lacking of scientific background, maybe? Because we we came with with a lot of, of numbers of, like, low adoption rate and people do not care about their security. They don't understand their security. I we put, like, a lot of numbers out there and you didn't. So don't you think you're lacking of scientific background? Yeah. I I I don't necessarily need scientific background here. We know that password manager adoption is raising. Right? It's built in in browsers, and people use it more and more. And, of course, it's a security tool so people are gonna complain. Like, it's like seat belts in the seventies. People were like, oh, I don't some states, they were like, oh, you can do whatever you want with the the seat belts. It's not mandatory. And then eventually, you know culture and you realize it saves it saves lives, and then it becomes mandatory after the fact. This is what will happen with password manager. It is happening right now. Alright. I think we have one more round of Volleys back and forth between both sides. Olivier, do you have any more questions? Yes. I want to address the LastPass, breach concern, and I wanna say that you have alternatives that are not relying on a pro on a vendor. You can use KeePass, and you can have it synchronized in a Dropbox or some sort of Google Drive or OneDrive, and it's perfectly fine. You're not relying on a vendor. You're relying on proven, tested cryptography. So how do you respond to that? Sorry. What? The last pass bridge being irrelevant. last pass. I'm sorry, Elvia. I just missed. Can we give him ten seconds to just repeat this? I was deconcentrated. No. I win. did have nothing to say. Now it's your turn to ask me a question. well, that's fine by me. My time the calendar did. So right. you you said it's better than nothing, basically. This is your argument. But nobody is debating, like, is defending the the, like, not having a password at, having bad password versus a password manager. It's not the manager versus nothing. It's manager versus the other low cost option that don't require you trusting a new third party with every credential you own. So you're kind of in the false binary here. And, like, better than nothing assumes correct adoption and configuration, but you already show that adoption we already show that adoption is low. That's not a question, Adrian. Yeah. I'm coming to my question. So so, how can you say it's better than nothing if, like, nothing sounds pretty fine for me now? It's not. It's it's really not. It's not it's not working. People are getting compromised. People are reusing password all the time. And we we see it. You look at Steeler logs like I do. Like, we see the amount of password we use there is. And this is how accounts getting are getting compromised. This is how organizations are getting compromised. So something needs to be done, you know. And I think that advocating against password manager as an expert, you're hurting the whole thing we're trying to do with the with the with the the general population. Right? Accel, Chris, you are now able to join the ring, and our three minutes have been added to the timer. At this point, we will remove all restrictions on being polite and going back and forth. I Starting in I three, two, one. Cross well, fire. I think that, you know, you you said that, you characterize our argument as it's password managers versus nothing. It's better than nothing. I say that I claim that it's better than everything else. It's better than anything, else that that in terms of usability and security, it's better than anything else. All of these issues that I I think that we've heard raised are issues with the individual vendors, issues with the defaults in the software, or issues with user education. I think that's all I have. But it doesn't work. Like, people don't use it. It's not because you can't use it that it doesn't work for everybody, Andreanne. Sorry. Okay. Look, a teacher's job is to teach. A nurse job is to care for patient. Your job is to make tools that people use and that will keep themselves. We cannot ask people to be safe. Like, it's it's not their job. It's our job. I mean, I'm not a password manager designer. I would be terrible at it. You know how like, my favorite software are CLI tools. So, yeah, it's it's not it's not working here. So, who here like, in a group of of five people on stage, who who uses at least one password manager, day in, day out? Alright. Alright. Now who uses more than two? Okay. More than three? But but as you see, we're all security practitioners. And here, Yeah. password managers are just created by and used by security practitioners in majority. So right now, we are getting even more secured, but we were already secured because we had good practices. Whereas we advocate for the awareness and security knowledge of the other part that does not use it and would benefit from it. Because right now, we're just deepening the differences in security for people. We're basically fortifying an already fortified castle when the house downtown are just burning. Forty five seconds, folks. And so your argument is to just complain that this that the rest of the population suck instead of trying to improve the. situation by education? No. We are advocating for education before telling them, no. No. No. You should absolutely have a a password manager even if you don't know why and how to use it. We want to make sure people know how to before we tell them, yes. You should have one. Absolutely. We are also advocating for a world without password manager. It will be very simple, like, with no password at all. This is a solution. What would that word look like? Passkey, Kevin. for example. This is the future. Pass we are stored. in a password manager, by the way, Well, in your operating system. that's time, ladies and gentlemen. I wish I could hear more about. Unfortunately, we are on a schedule. So the debate is now properly done and dusted. But it's not our debaters who are deciding who wins. It's not even me. It's going to be you guys. So soon, a survey will be launched, and you get to vote. Password managers, Are they worth the butter? Let me click through some buttons, and poll is open. Please check the tab in your chat and vote who ultimately won this round of debate. I'm obviously voting for myself here. I forgot the debaters are allowed to vote for themselves. Whoopsie. Alright. Let's take a look at some numbers. I We regressed. Oh, no. Damn. Wow. I never. saw take that as a win. I will take that as a win. it. Ben's side opposition takes the cup and wins. Let's give him a round of applause, ladies and gentlemen. Whoo. And so it is with a heavy heart that we call in a close to the debate section of the Summer Slam. It's a wrap, folks. Now we're gonna cool things down and switch gears. We're gonna be moving from the debate stage to a little fireside chat, a little bit more relaxed, a little bit more conversation. But before we settle in, we need one thing from you. And I am reading a little script, and it says there is gonna be a poll that's gonna go live now. We want your honest take on the DNS. Almost said DNS system. Almost said chai tea. Let's talk about the domain name system. Polls opened up, chat, and we are able to take down our previous debaters. Thank you so much for your time. That was awesome, Dylan. Thank you, Joe. So the poll's up. Pull is up. And, the DNS. Is it, is it flawed? Do we feel comfortable with it? Do we think, you know, it's it's just been the same for too long? We've got mean, some some great minds to talk about this. I mean, personally, I have a problem with the name. It just makes you want to say system. You know? Like, you say ATM machine, but, really, you're saying machine twice. It just feels better with a system at the end on top of the acronym. You know? It I'm, not out. there. Yeah. Alright. Let's, we got some questions in the q and a, it looks like. I just wanna also to let people know that we will leave time at the end for q and a, so please put your questions in the in the q and a. You'll find it on the right side of your screen. Alright. Should we bring up the speakers, Gil? Yep. Let's do it, Dylan. I think you could take the poll down. Yes, sir. And I will be happily uninviting myself off the stage. See you on the flip side, folks. We're gonna get, bye. Olivia up here too. One sec. Alright, gang. So this one was originally supposed to be a two v two, but we had, conflict pop up. One of our teammates wasn't able to join us. So we're gonna turn this into, a little courtside chat about the state of DNS, and I wanted to, yeah. Jerry, are you ready to party? Bro, I am so ready to party. After the energy that came off of that wicked hot, like, you know, I know. That was awesome. basically digital fist fight that just went down, yeah, I'm I'm ready for this. Alright. Cool. So I know, you actually listened in to one of the threat briefings that Adrian gave on a top similar topic. So, Adrian, if, if we could pass it to you kinda just to set the table, and then we can go around the horn and just just have a little casual conversation about the state of DNS, and the chat is encouraged to, participate. Always makes a great dialogue. Yeah. No. That that's great. You know, I was really concerned that I was gonna have to take take on Adrian at one point there, so I'm just glad it's another video instead. Yeah. So DNS, it's a shame that we're not going to have a debate. You know, I'm going to try and do this as quickly as possible, but one thing that we I'm going to start with, you know, just reminding people, it's the most successful distributed database that has ever been built. It's been going for forty more than forty years. It gets billions of queries per second. And from the DNS raw data perspective, it has a near zero global downtime. I mean, no other system, no other database ever built can come even close to that. And when we do have issues, when there is problems and everyone starts screaming, DNS is broken, DNS is not doing this. DNS is not doing that. When we get down to the root cause issue, what is normally the problem? It's us. It's the humans. The humans have screwed up somewhere by not doing something, by flicking a switch, by changing a setting, by doing something. DNS itself has continued to work in the background. So it's I I I really want to get that point across first because operator error is the biggest cause for everyone shouting that DNS is broken. I'm gonna stop there and see if anyone wants to chime in at this point. Otherwise, I will just keep going. So I can take a stab. So first of all, I agree with you. It's since the eighties, and it was the second thing, I think, or a protocol they, they inserted. And it's a huge thing, the DNS. But I also can argue against DNS that maybe because it's so robust, maybe because it's so widely used, and maybe because we rely on it so much, we are not giving, enough opportunities to alternative to alternative methods. And, also, maybe we are not addressing too much to the problems of DNS. For instance, if I want to write a subdomain in some, in some conditions. I can write a subdomains to other people, and it can work if I got, as an attacker, if I got access to, to the main domain. And then I can write a subdomain, and I can hide inside the subdomain of a government. Today, I got an email from the Argentinian government that I won a free, Tesla. So, obviously, I wanted to run and get the Tesla. And when you go and check, the domain, it's indeed the Argentinian authority, to ride vehicles, but, obviously, they didn't, I didn't, win, free Tesla. So what I'm trying to say is maybe because it's so robust, maybe because it's so popular, maybe because it's, as you said, the greatest and most efficient database, maybe we don't give enough, opportunity to, competing methods or rising methods like the blockchain, for instance, just all the HTTP over, or DNS over HTTP. Maybe we are not giving enough opportunities to these kinds of methods. I, so we are talking about replacing DNS, but no one said what's the problem with DNS. And I wanna say what's my problem with DNS is, the privacy issues with DNS. And I'll give one example. If you're at an in a hotel with open Wi Fi and you open Wireshark, you can know who everyone surrounding you, who they are working with because DNS is used for everything. Our computer sends thousands of DNS requests all over the place, and you see, like, which Slack they are connected to. You see all sorts of stuff. So this is an advantage as a malware researcher because I can, use passive DNS to find malware infrastructure very easily. So I like that part. This is why I think DNS is nice for me. But the the flip side, the privacy concerns are crazy and it's not getting away. They tried to deploy DNSSEC. They tried to deploy DNS over HTTPS, but none of this works is is enabled by default and works well. So, like, this, I think, is the problem, with DNS that should be, taken care of. But at the same time, it will hurt security research. So, like, I don't know what to do. Yeah. I mean, sir yeah. Oh, go ahead, Asaf. of. Yes. But kind of like the registration. So we had, to, because of the GDPR to remove all the data from the, registration who so, basically, it will help in the same way. Right? I'm supporting you, Olivia. Yeah. And I'm like, so DNS got created. I I I don't even know the exact date, so don't don't fact check me on this. But I'd probably say, like, around the seventies. Right? Seventies, eighties, maybe? I mean, it really it really took off when the dot com boom happened and everything. But any tech, any protocol designed in that era, they didn't even really think about, cybersecurity. Right? If you look at, h l seven and health care, if you look at Telnet and FTP and all these other ones. So, you know, it is an antiquated, tech. My opinion on this and, again, I know you guys have thrown Intel Research. I'll pose a question in a minute, but I'm almost thinking it it is so ingrained and so critical to just the very fabric of how society operates online that ripping in and replacing it, I I don't know if you can really build something alongside it, like a bridge next to a a a a a bridge that's falling apart and then have traffic route over versus, like, one big kind of cutover day. So, you know, like you mentioned, Oliver, DNSSEC is supposed to be, like, kind of the bolted on solution to that, not necessarily, agreeing with that. I mean, do you guys think that, the the the approach of DNS and how it's managed kind of by the nonprofits and internationally, lends it to be, a benefit or in a, kind of a a problem, for, you know, the security and management of it? Adrian, I'm wanna take just yeah. No. I was I was just wondering if it's a bit like FIFA. I've got the? referee on my side. This is fantastic. Yeah. Hey. By the way, that that check hasn't cleared yet, Adrian. So, you're on the you're on the clock. It's in the mail. It's in. the mail. Yep. Yeah. I mean, going back to South Point around registrations and GDPR, etcetera, that's not a DNS problem. That's Jerry, that's the point you just hit, but that's the governance problem. The the raw data is still there. Now having a system that is self governed and self managed by the same people as running the system, that's a that's gonna be a problem. That's that is a problem because they are effectively telling, us users, everyday users, you know, what they can and can't do, what they can and can't see, what they can and can't access. That is a fundamental problem, but that's also, again, been a fundamental problem since day one. If you look at the who the the who is element of, of the, the system, that's never been accurate. 2009 when they brought out the first RIA, registered accreditation agreement from ICANN, there was absolutely nothing in there at all about the who is details being correct. You had websites registered by, Mickey Mouse at Disneyland. You you and, you know, they would have hundreds of thousands of websites, and no one was doing anything about them. They changed that in the 2013 RAA or they tried to change that in the 2013 RAA. But, again, they put the power back into the people who are running the Internet, the ISPs, the registrars, etcetera, etcetera, and they decided to they chose not to look at certain things. So you were still seeing websites registered by Mickey Mouse, care of Disneyland, even though the rules said that you couldn't. That's not a DNS problem. That's a that's a management. That's a fundamental platform problem. So, again, the argument of who is this broken, it's a sound argument, but that argument is a separate argument to DNS is broken. But I will concede, and this is one of the few points I will concede, is that, privacy was never a part of the original design for for DNS, but it is a bolt on. And to Olivia's point, that bolt on has to be turned on by someone. It's not on by default because, again, not everyone will agree that it's on by default. That comes back to the human element and the management issue, not the DNS problem. So from my reading about DNSSEC, the issue is, the the the cost the cryptographic cost is very high, especially for nonexisting record. There's a very good technical writing that that that outlined that. This is why they basically gave up for the NS SEC. Like, the the the IETF said, we're not doing this. It's it's not working. But now it needs to have a redesign and someone else, you know, retrying for real. In the meantime, DNS over HTTPS is a stub gap. Asaf, any final thoughts on d n oh, wait. Joe's coming on. I was I was trying to, you know, dance up here for you. Any final thoughts, Esoph, real quick? I think we have about thirty seconds. Yeah. I must say I'm I'm conflicted because I'm, pro and against at the same time. I must say that what it's like, Olivia said, I think. Basically, it helps us to find, the attackers. On the other hand, it also enables attackers to use the DNS system for them. For instance, for, for the whatever. So because of time lack of time, I'll pass it on. I love it. Alright. Thank you so much, Joe. What do we got, Bubba? Well, I think, it's time for a TV time out, and I wanted to to draw the attention to the chat. Angela is gonna put some instructions in there. We're gonna run a giveaway for everybody who's in attendance. It's very small token of our appreciation for your time. And, yeah, keep a lookout on that. And I'm gonna queue up this video in honor of, the World Cup. We're gonna take a little thirty second hydration break. Okay. Well, I am I am the worst with, like, awkward silence and waiting. So that two minutes turned into, I think, fifteen seconds. No. It's perfect. It's perfect. I I it wasn't awkward at all, Joe. So alright. Good. Yeah. So we'll just give the the panel time to just get gathered and get ready to come up on stage. And then, Jerry, real quick, you you and I wanna just let the audience know what we're gonna be talking about on the panel. Yeah. Heck yeah, man. So the cybercrime panel that we're gonna be having today, it's gonna be talking about the shape of the threat landscape. But right now, there's no fixed order. It's just gonna be an honest exchange between threat intelligence experts. And, dude, it is super cool. One of the rare, rare things that you guys are getting access to right now is people who, like, live and breathe their full time job in basically throwing on a pair of waiters and getting into the muck of the cybercriminal underbelly. You and I, Joe, right, and and people in chat. Right? Sierra Montgomery and Chad, Philip Martin, Kyle, so many of you in chat right now. We read the threat intelligence reports. We get the IOCs. We get notified by ISACs and stuff like that. But if you go upstream, it's the people who are about to be on this panel that are getting their fingernails filthy and just really, really getting that raw telemetry and seeing these logs, seeing these conversations, and so much more. I I gotta tell you, I couldn't personally do it, and not not that, like, you know, it's, like, beneath me or whatever. It's just like, I I I don't know if I could really do it and do it as well as the threat intelligence researchers at Flare. So we're gonna get access to this panel, and we're gonna be talking about threat actor profiling. We're gonna be talking about threat landscape. I am gonna try to be facilitating a lot of this. I've abused my, stripes, if you will. My whistle got lost here, so I can't blow that, but I can mute people. So if you guys have questions in chat too that are specifically interesting to you, drop them in chat because we want this panel to be engaging and fun and also just a good time for everybody in the audience. Look at this star list right here. Jesus. Pulling out the stops flare. Hey, Tammy. How are you? Could you? It's good to see you. Adrian, who was just crushing it in DS. Andrean, knuckles are still red from punching, punching Oliver there and Chris Dion bringing the strong password vault argument. Guys, so I hope you're excited. Thank you so much for taking the time and sharing all this great information today. Let's start right off, the top, if we will. Tammy, I know, you've been off stage for just a few minutes, so let's get digging in with you. When you're dealing with threat actor groups and stuff, what's the first signal that tells you who you're dealing with? Because there are so many different threat actors out there. Yeah. So one thing I like to to look at is reputation with the community. What are other people saying about them? You can't necessarily validate someone's identity just by, like, one on one, unless you have intimate knowledge of the other person, in private conversation before and you're trying to revalidate someone, then there's other ways you can do it. And it gets more complicated and it gets harder to do, and then it's like also, it's like a return on investment of your time and effort of how much time you wanna put into identifying and de anonymizing and figuring someone and attributing something. But, really, the first thing you wanna do is is look at, like, what people's status is across different forums, different boards, different communities, different chats, and, also, like, how they respond to different, pressures. Right? That's a big one that a lot of people can't really, hide. And so when someone and this is something more that doesn't necessarily happen that often in in the public front. But on the back end, you can start to see it a lot because when you're under pressure and you have a lot of stress, that is more of a biomechanical reaction to, to something. So if you're working alongside someone and they're under stress because they just attacked the big company and then the the negotiations are going sideways or something like that, and they're stressed and they're talking about it in the chat, And you've seen this type of, like, stress before, the words that they use because when you're under under stress, a lot of stress, everything is just purely instinctual. Right? Your vocabulary shrinks. Everything shrinks. Your your attention span shrinks. And so you can see the core foundation of someone's personality when they're under heavy load and under heavy stress. That's if they're the type of personality to engage with someone. Right? A lot of people just like the the the ability of online and and is like you don't have to commit to a lot of stuff. So you could just like dip, which is and ghost, which is something that's very interesting and happens all the time. But then that also tells you, like, how how trustworthy someone is. But that's that's some of the things that I like to to take a look at and and really try to gauge someone's seriousness and credibility in this in the underground is is really about how they handle stress and how to handle pressure. Well, just as a quick follow-up, Tammy, you just said something that caught me, by surprise. So I'm a threat actor. Okay? And I just popped, you know, fortune four 199 company. Right? Whatever. Like, not not not a fortune 50, but a pretty good, you know, line item here, publicly traded company. Why am I under stress? Like, you know, I've got I've done the infection. I've got the ransomware. I I may or may not get paid. Where is the stress coming from for this particular individual? So there's there's always the paranoia of OPSEC. There's that's always there. That's always there. No look at so a prime example is, not just OPSEC, but also morality and ethics. Look at, Blackbasta's, chat leaks. And when they hit, they hit a big, like, medical company, and, essentially, the negotiators were telling Blackbasta that, you've got hand like, you've got lives on your hands right now because we can't get we can't route ambulances properly. Medical, reports are not getting filed properly and stuff like that. So that, that put a lot of pressure on some of the affiliates, not necessarily the top brass at the very, very top, but the affiliates didn't want didn't because it's a team effort. Right? And they didn't necessarily want to continue down this road. And a lot of them them saying, like, I'll never attack something like this again. Like, I I'm and I know a lot of people were and a lot of them were extremely vocal about how discontent they were and to the point where they were saying, like, I don't even care. Let's like, I wanna I just wanna get rid of this. I I hate this. I, let's give them a free decrypter if we have to, and, just to just to stop this paranoia, this pain of and stress of, like, what they had just inflicted upon other people. Because most of the time, like you say, hacking is, most of the time, a painless crime. You're not necessarily inflicting, like, pain on someone. Right? It's not like you're punching someone in the face. Hacking violates consent. It violates someone's, personal space, but it's done at a distance. And you have this ability to keep arm's length away from them and tell yourself that for a myriad of reasons that what you're doing could be morally superior or some way of justification of of your of your of your thing of your attack. It's for money. I'm doing it. I need the money for a good reason. They deserve it, which is all part of psychology and criminology and, like, all different ways of interpreting, like, motives and and justifications for it. But it it's still underlying like, it still produces a tremendous amount of stress in in people. And yeah. That's fascinating. Thank you for that, deeper explanation and understanding. Definitely changing the assumptions I had of the threat actor behind the keyboard. Chris, I wanna turn the conversation to you right now. You know, as someone who works in this every day, is tooling alone versus behavior and targeting which which one tells you more as a threat intelligence researcher? That's a hard one. I I I mean, I am not, the goat like like Tammy or Adrian. You know, I have my own niches, and I can tell you from my small niche, that I have done research in, I will absolutely say that, both of these things can can be misleading. You know, there was an attack, I think, in 2018 on the Olympics in South Korea. The tooling, the infrastructure, the malware that was used, the sort of code traces pointed to North Korea, and the targeting pointed to North Korea. So there was all of this evidence and and the motives toward North Korea, but it was not North Korea. It was it was Russia. So I think that, yeah, tooling can be misleading. And also, you know, certainly, there has been a convergence where, you know, everybody and their mother is using Cobalt Strike and Mimikatz. Like, how the hell do you know who's attacking you? It's hard to tell. I again, I have absolutely no knowledge, not the knowledge of KAMI with regards to the ransomware ecosystem, things like that, but, yeah, I think both of them can be very, very misleading. Yeah. And I know for a fact with the, Vault seven leaks in the CIA back in the day, there was, you know, infrastructure in there where you could just kind of drop whether it was, oh my god, like Russian, Chinese, and a couple different languages that you could just leave forensic, fingerprints in to match that. So definitely, you know, first world powers, nation state threat actors have that capability. Adrian, one thing that comes up all the time, you know, we saw Darkseid, then Black Matter, then, you know, you know, ultimately went all the way down to potentially Ransomhub. Ransomhub seen as a new threat actor. How do we know or how do you know or how do you put insights into this? When is it a new threat actor versus a rebrand? Wait. Where's the line on this, Adrian? It's a very, very gray fuzzy line, and that's that's part of the problem. And and and often, this is why attribution is the is a fool's game to a certain point, because rebranding happens at the start of every you know, a new campaign comes up. It's a rebrand. Lost count the amount of times a ransomware actor has, you know, publicly said, we're closing down. Yeah. This is it. You'll never hear from us again. Then, you know, three days later, suddenly, there's an there's a, you know, a new variant of of somethingness. And people move between groups often as well, whether it's politics internal politics, whether it's more money, whether it's a different ideological view. So they bring their experience and knowledge with you. So you get to the point where, you know, one guy and one group is is using some methodology, as Chris mentioned, that matches somebody else's methodology. I mean, in truth, people piggyback off something that works. So if you've got a naming convention or you've got a particular methodology that works and has seen it successful, then somebody will come along and piggyback off that, whether it's using code segments or whether it's using, something net new. So it becomes very blurred at that point. There is always going to be someone net new, but at the same time, they either have to hit big in terms of you know, it has to be, you know, Fortune 500 company top 10 list, whatever it happens to be, and really make an announcement there. Or they're starting small, and they're going for the volume game. And the volume tech game takes time to establish that reputation. And if it's not happening quick enough internally, you then get the arguments over, well, we're not getting paid. Why are we doing this money? We're not getting money. And then they start bringing in the the technology, the processes, the code from somebody else that has been leaked that is working, and then it gets blurred at that particular point. So from my angle, it's a very, very wavy gray line, and it's not easy to actually turn around and say, this is a brand new NetActor. Although, from a sales perspective, if you look at, you know, all the boutique organizations, somebody always has to come out and say, this is brand new, high-tech, NetAct, you know, never been seen before. And, you know, people like us are sitting in the background going, no. No. We've seen this, you know, many times. It's just you know, it's it's the same flavor, just with a different color. Thank you, Adrian. I definitely appreciate that. And and, you know, for better or worse, whenever I see a threat actor say, like, they're going they're going down, but then, you know, like, the the elf v black hat to Ransom Hub, I was immediately like, oh, Ransom Hub's just a rebrand. Although a lot of the, TTPs coming out afterward would suggest it was not a rebrand, but I I don't know. I personally always default to it's a it's a rebrand because it's just too lucrative and too too useful to to abandon that. Tammy, I wanted to throw a question to you. Not one of the ones that I had, thought about before, but just as it's coming up. You know, Adrian's been talking about this rebrand and and about the market of ransomware specifically. I I'm really curious based on your experience. We have seen ransomware threat actors for years, and now we see ransomware as a service. We've seen different kinds of ransomware where it's encrypting devices or ex filling and then selling data back or not selling data to competitors. Is there a natural evolution within this cybercriminal ecosystem space of, like, you know, it's like me and Adrian, and we're gonna start a ransomware thing, and we're doing it. And then we realize it's it's more profitable or we have the infrastructure and we're gonna sell it, or is it more just kind of, you know, a bunch of people doing a bunch of different things? Is is there any type of evolutionary track that you've seen? Yeah. That's that's a great question. So it's a business. Right? And well, at least it tries to be a business. But this it's there to be a business. What I what I see is a lot of people think they can do this. And the they, like Adrian said, they they grab some leak, like, lock with a black builder out there or some other builder, and, they put it behind, like, a web panel. And, they say, okay. I can now we can be a RaaS and ransomware as a service. I'll start up, like, a next cloud or, like, some NAS and I can host victim data. I'll host it on tour. Like, at a fundamental level, the basics are simple. It makes sense. The the the thing is is the real hard part is that there are different levels to this game, and not everybody is cut out for it. Right? Not everyone's cut out to to do it, and not everybody has the technical skill sets to execute the full kill chain from a to zed and then commit lawn money laundering afterwards. Because when you go from a digital world to an you wanna go to the real world, you need connections in the real world. And a lot of that time, those connections come as in the form of, like, organized crime, through gang affiliations in the real world. And especially if you're doing, like, money track like, money mew money laundering and mules and stuff like that, and you wanna cash out, you you need people you need to work with. And especially if you've been sitting on a desk in your at your gaming rig and you think you can do this because it seems simple. You might get up to having a couple ransoms in a Bitcoin wallet or a Monero wallet, but, like, how do you cash out? It's that's the hardest part. And now what we're seeing as that's, like, been up to, I would say, like, 2024. Right? But now with the advent of more and more AIs coming out, especially the open weight models, which is what I'm studying a lot right now, the what's what's fascinating is a lot of the code that people use to build the dedicated leak sites or the, like, before it was mostly either a developer would build the the the the the DLS or, like, the, the payloads and stuff. But now we're seeing more and more, like, payloads and and sites being created by AI, and that makes it more difficult to fingerprint because AI removes that human touch from it. And when you see, like, all these, like, cookie cutter, like, Vibe coded sites, it's like, okay. Anyone could have made that. It makes it harder to to understand. But there's some but it doesn't necessarily like, you you lose some of that granularity of, like, looking at the code and seeing someone, like, type something a certain way and do something a certain way. AI will have, like, a foundational and framework knowledge of, like, okay. This is how it's gonna I'm gonna build this. But what people like and specifically someone that that is a VICoder, not necessarily a software engineer or developer, once they find an AI that works, they'll stick with it. I don't know. It looks like. Tammy gonna stick with it. got stuck. Oh, no. It shouldn't. My bad. Maybe it was my feed that got stuck. I'm sorry, Tammy. Please continue. Yeah. And, so, basically, like, once, like, you someone finds an AI that they're used to and they like, they'll continue with it, and they'll they'll stick with it. But, it's also, like, the tools that the AI uses. Like, you can also see, like, an AI was trained on a specific way to incorporate specific technologies together and to change specific things based on what it's seen people do, and it will replicate that that as well. So AIs are really hard to think outside of the boxes specifically in a, in a more of an adaptive way of of a creative way of of linking technologies together. And, so if you see, like, something that is interest like, there I I I'm trying not to to say too much, but there's there's new, ways of people leveraging, like, really interesting defensive mechanisms on their websites in terms of, like, proof of work and hashing and things like that that make it unique to them, and it's like a signature now. And you don't see other groups using it. And then you can also think of, like, oh, like, that is becoming a signature. So you're seeing an evolution in that way as well. There's there's a whole bunch of different ways that it goes, but, I'll I'll leave the table for I'll pass the ball to, to the next person. Yeah. I love it, Tammy. We'll come back in a little bit to talk about AI with you. But, you know, Adrian had what some people would consider a spicy take on attribution, a moment ago. Chris, I wanna throw it to you. How useful is attribution when it comes to defenders? Well, yeah. I mean, I'm of two minds about this as I'm sure most people are. I think on an operational day to day level, if you are a a SOC analyst or you're a a CISO, it you know, if you see somebody is on your in your network or somebody exfiltrated data or somebody phished one of your employees. You know, there is there are more pressing operational concerns, like how do we secure our network against these kinds of attacks, how do we, educate our employees against these against phishing, etcetera, etcetera. So at the end of the day, a lot of the time, operationally, attribution may not matter, to defenders on a technical level. However, I think for stakeholders and for executives and even if we're gonna go higher for policymakers, I think it does matter. If you let's say you are running Palantir. It is interesting for you as an executive of Palantir to know whether you are being targeted by a hacktivist group or a ransomware group or a nation state. All of these people want different things, and you need to defend against different You would need to defend differently against them. You know, if it's a nation state actor, maybe they're in your router or or your switch infrastructure. However, if it's a hacktivist group, maybe they're just interested in finding an employee list and saying, oh, here's an exposed list of Palantir employees. This is a different threat. So I think knowing at least not necessarily attributing every single alert that you get in your in your SOC dashboard, but knowing who's targeting you is is important. And so, you know, going through historically, your incidents that happen with you as an organization, I think it is very much worthwhile to know who's targeting you and why and sort of what to expect, with regards to what kind of attacks you're gonna have to look for and threat hunt for. I love it. So, yeah, it it has value. I definitely think and, you know, make some good arguments for Chris. Adrianne, I wanna I wanna throw one to you because I'm I'm sitting here as not a threat intelligence researcher. Again, I I preface the start of this panel by just outline how amazing, the talent is on this panel and and the work you guys do. Adrian, this is pretend I'm 10 or five, whatever. Would you choose choose the age you think that would be appropriate for me to have no clue? When you're doing your work, okay, is it are you anchored on, like, one threat actor group and you're doing all the things to get to that threat actor group? Are you anchored on one industry? Like, I'm only gonna be looking at financial stuff, so if something comes across and it's manufacturing related, I just push it to the side. Or or is it, like, whatever is hot that day or whatever your passions are? Like, can you kinda take me through how you anchor your work, day to day as a threat intelligence researcher? Yeah. I mean, I'll I'll just speak as myself, for for this because everyone every single researcher will work differently, and everyone will have their own, you know, skill sets, focuses, and and and everything else. But, I struggle to focus on one thing, one area. So I'm for me, where I start looking is where the cycles are going. So, you know, for example, we, you know, go through a cycle where health care is being targeted by literally everybody under the sun. So so at that point, everyone starts jumping into health care and starts researching, you know, threats, actors, etcetera, etcetera. But, really, for me, I'm then looking what's the next thing that's going down the line? After health care, what could possibly be next? You know, a lot of people didn't see FortiBleed come in because FortiBleed wasn't a compromise. It wasn't a hack. There wasn't a patch. It wasn't a zero day. It was doing exactly what it was supposed to do, and that data had been around for years in some cases from that perspective. So, really, for me, it's finding something that's new, that's novel, that potentially could be compromised, and then putting myself in the mindset of the bad guys, the generic bad guys, how would I then attack, compromise, manipulate this data that I've just seen, this just found, in a way that could significantly harm, impact, etcetera, an organization or a particular industry and so on. I'm really digging into that and, putting it out there for everyone to read. Sometimes, you the stars align, and you're you know, the the global industry is looking at the same thing you happen to be looking at at the same time, and maybe you have a slightly different spin, or maybe you're saying exactly the same thing. But, you know, for me, it's it's looking at what is coming and trying to be as proactive as possible rather than focusing on what we're focusing what's happening right now because very, very quickly, everything gets saturated, with, you know, everybody publishing the same thing, the same IOCs, the same techniques, the same TTPs without then focusing on what's coming next. So for me personally, I like to look at what could be coming down the line next rather than sitting there, and reporting on something which is currently happening, which, you know, everyone is reporting on at the same time. Fascinating. Thanks, Adrian. Tammy, I mentioned coming back to you on AI in a hot minute. I I wanted to get your thoughts. Like, everybody in Chad is using AI for various things, and AI security is almost like its own industry at this point. How in your workflows are you using AI? Like, is it changing how you profile threat actors? Is it just adding noise? Is it just making you more efficient? Can you talk to us about your integration of it? Yeah. So I I like to have it look at setting up scaffolding and frameworks for, analyzing datasets. That's one of the big re the things that I use it for. I like it as well to test concepts because one of the things about Vibe Coding and and just, like, that I like to do is I have an idea. I'm I could be outside walking and, listening to music. I get a a eureka moment. I I think about about a cool idea. And then I just basically, like, run it through AI, like Claude or or something like that just to to stress test the feasibility of the research scope and also what it would entail on a technological, like, on a technical level to to bring to fruition. Also, what I like to do is to ask it for because it's so like, I use it not necessarily for the deep expertise of it. What I like about it is that it how fast it is. And so I like to say, like, is this does anything like this exist, or does anything like this is it like, has anybody written about this already or thought of it this already? And it it's it's pretty good at giving me at least a good starting point to start my references and build out from there and to start my research. So, basically, in a nutshell, it's drastically accelerated the way I can, churn through bad ideas and get to the good ones. And, it also helps me build out, some much better, concepts and and, better data and and things like that. Better, like, better, like, frameworks to to bring my research to to people. I love it. Great. Hold on a sec. I was making sure I wasn't muted. I didn't wanna pull a Joe. You know what I'm saying? Dude, so, great use of AI. I love it. I I saw Zach and Chad talking about quick iteration, definitely a power use of AI. I wanna have a, take an opportunity since I'm wearing the, referee shirt and I get to, you know, hold the mic right now to ask a fun question of Chris. Now, Chris, this is something that I absolutely rant about on my morning show every morning when it comes up. Threat actors. You guys are constantly dealing with threat actors, but there's, like, a thousand naming conventions for all of them. In fact, it was in the news this morning that Google has released a new naming convention where they're taking existing threat actor names and bolting on a suffix that has, you know, relic or castle. Some some some, term that the first letter maps to the country or the the focus. Dude, talk to me for a second. As someone who lives and breathes threat intelligence and constantly dealing with threat actors, what what do you what's your position on the threat actor naming convention situation in our industry? Yeah. Well, I mean, the multiple conventions really, really, really piss me off. Like, it really it makes my job really hard to do. Frankly, I think that, you know, I don't necessarily love having to see threaded really good research being published where they they give me a huge string of numbers. UNC five four eight seven bro, I have no idea who that is, but I think that is is kind of has an advantage because now you're not making assumptions as to who these people are. You know? If you are saying, okay. This threat actor I'm gonna call, you know, Chewy Panda because I think they're from China and that they're not from China, you know, that really harms your reputation. So I I understand that the Google naming convention makes sense. However, I will say that I like just personally on aesthetic level, I don't mind code names. I like the Microsoft naming conventions. I think Salt Typhoon, Vault Typhoon, Jasper Sleet. I think the Storm etymology. I kinda like it. I don't know. I have no I have no reason to like it, but I think it sounds good. But, no, I mean, when last year, I was doing a lot of work with North Koreans, and you really just have such a hard time even teasing out who is who in these ecosystems because everybody's got different names, and they're over they're not necessarily one to one relationships between who these threat actors are. You know? One one threat intelligence shop might have a name for some actor from some state, and then some other shop has a name where it's like, okay. They might have overlap, but they consider other people to be part of Lazarus Group, for example. And so now nobody knows what the hell anybody's talking about when they say Lazarus Group, and it just is very, very confusing. I don't think that there is a solution to this. I think naming things, you know, I I spent many years as a computer programmer and in engineering, naming things is very difficult. And especially with CTI, it's very qualitative. There's a lot of fuzziness. There's a lot of unknowns. So, obviously, naming things is gonna be hard. So, you know, I tip my hat to to to Google and Microsoft. They take different approaches, but I think it's fine. But let you know, I I don't think it's ever gonna be solved. There's no solution to this. Yeah. No. I I agree with you a 100%. It can be frustrating. I I regularly tell people like, I've worked in the industry a long time. I it it probably, embarrassingly, took me, like, twelve years before I realized that they were talking about the same threat actor group with certain names, and I was like, oh my god. I wish somebody had told me that years ago. Hey. We're getting close on time here. I do wanna take one quick second, and just kinda go around the horn, kind of a lightning round, question answer period, thirty seconds responses. What I really want is each of your thoughts. We'll start with Adrian, move to Chris, and finish on Tammy. What what are your thoughts, guys, on what is the the value today? Like, what's the modern value if you could sum it up in in kinda one statement, your perspective on the value of threat intelligence, the output of the work you do. Yeah. The the value really, for me is showing showing the known unknowns and the known and the unknown knowns. Good. In the right the right order. Yeah. We can spend a lot of time. Chris mentioned we can have threat actors. You can have sexy names, TTPs, TLZs, etcetera. But at the end of the day, if your front door is unlocked with the key in the muck and the windows are wide open, there's no reason at all that anyone should be called a sophisticated threat actor because a five year old can point through the window. So it's showing people that that still exists and not to specifically focus on the sexy stuff, which is, you know, as in everything that's just been discussed, basic security hygiene is still our job as security researchers, threatened surgeons folks to say, hey. Your windows are open. Close the windows, and then you can focus on the Russians, the Chinese, the Iranians, etcetera, etcetera. Love it. Chris, same question, man. What's what's one value? Thirty seconds. Well, I think the value comes from the pipeline, from CTI to threat hunting threat hunting to sort of just the blue team at large to stakeholders in the company. That CTI is the input for further threat hunting and, further defense. And, also, I will say that, private sector intelligence is often less fettered than public sector intelligence. We have the freedom to do things and move more quickly than in the public sector. So that's an advantage. I love it. Thanks, Chris. Adrian, great points too. Tammy, round us out thirty seconds. What's the value of threat intelligence? Yeah. That's that's a great point. Like, a a lot of the times, it's seen as a cost center for a company, but, honestly, the the thing is that it's a it's a compounded investment. And the better that you have a team, the the more they're going to be resourceful and educated, to assist the company in terms of handling incidents or handling, any type of, crisis, or any type of of, more like, compliance check and things like that. So the it's it's really something that you it's it's all about experience. It's all about how you have people working with other people as well. It's not just machine to machine. Threat intelligence and CTI is is basically a, a translator between the human and and the and the digital world. So I love it. Thank you, Tammy. Guys, what an absolute banger of a panel. I I I genuinely appreciate it. Got a lot of insights, a lot of value, and just enriched myself as a cyber professional getting more well rounded. So let's go ahead and clear the court for our ace talks. Guys, this is gonna be four experts, five minute chi five minutes each. It's gonna be solo serves back to back. So if you had to, you know, go get a drink or something, you're gonna want to pause that right now because you're not gonna wanna single miss a single second of it. Joe, should I just give the lineup or you wanna you wanna chime in on this, my guy? I'm just watching the chat. Somebody's looking for a knife fight. Now you fight day maybe. yeah. We'll have to get the debaters back on stage here. Oliver and, on Andrean. Although she'll be on in a second without him on stage, so she might be able to just talk some trash about him without any opportunity for rebuttal. No red card Sean Gibson. I'm sorry. I'll I'll pull Adrian. Soon as Adrian speaks, I just flag him and and kick him off the stage. But, if you want, I'm happy to, introduce this hot talk that Adrian's about to drop on us. Let's do it. I love it. So Adrian Cheek, he's been here, just on that last panel, so you guys are all warmed up to how intelligent and how savvy he is. Adrian's gonna be talking on health care records, how DICOM systems leak patient PII through weak access controls. Adrian, the court Alright. There's only five minutes, so I'm gonna try is, yours. share my screen quickly because I did put together a very, very quick five minute five minute deck, but there we go. Look at that. And it so I'm gonna do this really, really quickly. So we're gonna look at health care. This is not a globally representative number. This is not taking global. We'll look at North America mostly because, you know, at the end of the day, it's one of the biggest health care, environments around the globe. But, you know, when we've gone through our research and we've published a whole bunch of stuff on on various different health care, but, you know, 19,000 Internet facing hosts have been observed, 13, almost 1,400 distinct health care organizations, and this is all done without sending a single packet to to any of them. So the key part where I said a minute ago about the windows being open, the front door being open, This is exactly what we're looking at now is, you know, all this information. So you're looking at two distinct countries in in in North America. You've got, you know, just just under 16,000, hosts, almost 1,200, health care organizations across all 50 states. Out of that, you're looking at 311 critical CVEs, seven nine dot zero, you know, tens across the board. And, 175 of those are distinct critical vulnerabilities. That's just in The US. And that's just a snapshot. That number can change on a daily daily basis. If you flip over to Canada, for the Canadians, you've got almost 3,500 house, 212 organizations in every single province is covered. Again, a 136 hosts with critical CV CVEs. The these are life altering, potentially life changing, life saving, or life ending, infrastructure within your hospital health care, and they're running with these CVEs, particularly, potentially exposed. And it's not so much that they have CVEs. Every organization, every single business around the world can have a CVE, can have critical, infrastructure. You can run Windows XP in your own infrastructure if you really, really wanted to. That's entirely up to you. It's a business decision. It's a risk decision. So why this is important is that every single number you're seeing on the screen is publicly facing. And as we've just heard in the last pieces, the you know, people are targeting, you know, threat actors are targeting these all the time. If you can see them, then they can see them. They're already mapping your environment. They're already mapping your infrastructure. And that's the scary piece. It's not so much that you have a prob you have a potential risk. Everyone has risks. It's how you manage that risk. It's the fact that you're broadcasting your risk to the entire population of the globe. So if the even if there isn't a zero day for that thing today, there might be a zero day next week. And then you'll be the first people to come on to, you know, press releases, essentially, saying, oh, extremely sophisticated threat actor has done this. Well, no. It it wasn't. So, you know, we'll get down to some of the nitty gritty. DICOM, these are the image consoles. You know, when you're you know, go for a scan, when you go for an X-ray, you know, they have to share that information between doctors and, you know, various different, organizations either internally or externally if you're going to a specialist care unit, etcetera, etcetera. Everyone, looks at DICOM on port 104. This is, again, this is, you know, information that's publicly available. 40% of those, consoles ask for no password at all. So, theoretically, if I wanted to, I could actually go and target one of them and have a look at every single person's, images or medical records that they're sending via that that particular platform. 96%, exposed viewers share two identical favicons. This this is copy and paste, copy and paste, copy and paste. There is nothing sophisticated about this at all. But it's a protocol which your EDRs, your policies, your VM tools, your, vectors, etcetera, etcetera. None of those tools are looking at this. So you're not gonna know it's there unless you're looking for it. So, we're gonna quickly jump onto AI, in this particular, case that ninety four point four percent of prompting injection attacks succeeded across 216 simulated clinical dialogues. This is actually in the notes itself. The model could not tell the difference between an instruction, and a malicious instruction, because both of them just arrive in stream of text. The payload is hidden is is language. It's hidden in a referral letter. It's a portal message. There is, I think it was this week or last week where a professor somewhere, called out their entire entire students by putting white text, in in the assignment credentials, criteria. And no single student, or I think it's, like, three percent of students actually identified there was white text in there. Same thing happens here. But the scary part is it's 94.44%. Even point 1% is scary because these are notes internally shared. If you think about it, you're lying in the hospital bed, waiting for something surgery or waiting for something, and you have an extreme allergic reaction to a particular piece of medication. Your records will say that or, hopefully, it will say that I am allergic to this. Someone could maliciously come along and wipe that from your medical record, and without even touching the infrastructure or walking inside the building. That's where the wrong recommendation starts to impact or potentially kills the patient. FDA, the change control governs how the model may evolve, but it doesn't actually go into, how or whether it can be talked into harming a patient. All of the governance, the regulations that are currently set right now are all about what you should and shouldn't do around, let's just say, physical hardware. This shouldn't do that. You should have firewalls. This shouldn't do that. None of them are governing AI and what AI should be doing inside an environment or how any how AI should be used when it comes to medical records. And then, it's advisory trade practice already in the estate. So some scary numbers. Again, they may not look too high, but when you look at, the recent Iranian conflict and the, AA twenty six zero nine seven a, oh, it's on top of the screen, advisory that came out, that advisory on the April 7 was really aimed at the manufacturing industry, IoT. It was but when you actually read through that, it actually had a more significant impact. For example, in in The US, four Rockwell Ethernet endpoints on public Internet, for one health provider. That was specifically called out in that advisory as something that the Iranians were targeting. 45 VNC endpoints exposed by a single organization in Farmington. That is, like I said before, even one is too high. But this is a CSAF, FBI, NSA, EPA. The you rarely see all those acronyms coming together to put out a joint advisory. But the way the advisory was worded, it was aimed at manufacturing. So a lot of other organizations, a lot of business businesses decided to not necessarily ignore it, but, they didn't pay attention to it. In health care, the same thing, the same, endpoints apply as they would in manufacturing. It's IoT, etcetera. So, we saw how disruptive the Iranians or Iranian proxies could be during the recent conflict. I'm not gonna mention the organization because that's not particularly fair, but it wiped that health care organization off the map essentially for four to five weeks. That wasn't down to a lack of security controls. That was down to the fact their credentials were being leaked, and they were not being remediated. So it's it's not sophisticated, but this is health care. This is something which will impact every single one of us in some way, shape, or form where, we're still focusing on the, again, I'll say, the sexy stuff, the the hardening the outer shell without realizing that our gooey inner core is leaking through that outer shell, and we're just not paying attention to it. That's my five minutes. I don't have anything else. I'm gonna hand it back over to Jerry. Thanks. Awesome, Adrian. Fastest five minutes in cyber. Next. up is Chris on Telegram marketplaces. How Chinese language crime moved off the dark web forms and onto Telegram. Chris, the ball is yours to serve, bud. Alright. Thank you so much, Jerry. Let me share my screen quick here. Alright. So we're talking Chinese language guarantee marketplaces. So if you have ever received a text, that is obviously a scam text or call or email, maybe not an email, but scam text and calls generally are coming from, call centers or bot farms or just otherwise compounds in Southeast Asia being run by Chinese nationals generally associated with organized crime. There this is sort of the the the the background of these marketplaces. What these marketplaces need, though I'm sorry. What scam compounds need is a place to buy and sell, things like SIM cards, personal information, to recruit people, and also to launder money. With there needs to be some kind of scalable, large scale, industrial scale financial platform for all of this illicit activity, and this is where guarantee marketplaces came about. They are in they're on Telegram, and they're run by the organized criminals that that generally are affiliated also with these scam compounds. So like I said, they broker, assets like, you know, again, SIM cards, social engineering databases, things like that, and then they also provide financial infrastructure for money laundering in many different capacities. So it is the input and the output from the scam center economy. The scam centers cannot operate at scale without a scalable financial substrate. These marketplaces are called Danbao, which means guarantee in Chinese. But in the early two thousands, Alipay, popularized the term Danbao jiaoyi to mean a guaranteed transaction, but, in, in in sort of a a more meaningful the semantic meaning is more of an escrow. So it's an escrow service. You, as a vendor of products for illicit marketplaces, can, create a Telegram account, create a Telegram channel, and deposit cryptocurrency, and that platform will act as an escrow. So you provide SIM cards to to a buyer, the buyer receives the SIM cards, the escrow gets released. It's cryptocurrency escrow mediated on Telegram. Dunbao was used in a lot of different ways. Obviously, Alipay in the early two thousands. You see here there's a screenshot from a Bitcoin forum. I think this is from, like, 2013 where somebody's asking to buy Bitcoin, and they're saying, So we could use a trusted intermediary to act as a guarantor, like Danbao, or we could use Alipay escrow, Danbao, Jiaoyi. So, Danbao is is very commonly used in Chinese ecommerce, and I apologize for my Chinese pronunciation. So here's some of the services. These are there are lots of different players in the game. It the ecosystem has kind of, been built out, has been sort of scattered. There were sanctions actions on some of the big players. There were law enforcement actions, Telegram takedowns, etcetera, but the ecosystem is huge. There's billions of dollars. So, yeah, it's money laundering. You you know, there's people who say, I'm looking for money mules, to give me their Alipay account so that I can move cryptocurrency x number of times a day to launder my money. And then you hire them, and and it's all done on this, on this platform. Again, they sell fishing kits. They sell malware. They sell, gambling platforms. They sell kits to make gambling platforms. They sell, you know, stolen data, literally anything. It's a one stop shop. And so this is a screenshot of, sort of the directory of of what, what, what is available on one of these channels. Yeah. I mean, Huayuan guarantee was the big player that got taken down a couple years ago. They processed over $27,000,000,000. SinB and Tudo, again, like, $10,000,000,000, $12,000,000,000. It's crazy. The again, it's really scattered. There's tons and tons of players now, but it's very highly active, and you are getting scammed by people in Southeast Asia who are being human trafficked by organized criminals who run money through these platforms, and it is, relevant to your interests. Thank you. I appreciate it. You're muted there, Joe. I didn't have any coffee in my, mouth to spit out there. So, Chris, thank you. That was awesome. Really insightful and a little horrifying. Next up, everybody, we have the man, the myth, the legend, Olivier, who's gonna you heard him say earlier, you know, he Yes. he, lives and breathes stealer logs, reviews them for a living. Olivier, can you just give the audience, an overview of what it is that you're looking at in the Steeler logs? Yeah. You don't want me to do the the deck, the slides? You want me to do an. intro? Nope. No. However you were gonna do it is fine. This is. cool. Well okay. So yeah. I guess I could I should do a TLDR about the Steeler logs. So Steeler logs is a cybercrime artifact that is sold on between cybercriminals. It is the result of a single infection of a computer where everything that the malware can access, it exfiltrates. So the malware itself, they're called information stealers or in French, a neologist that Eric Boivin, a colleague of mine, came up with. So this does an infection. They steal everything that is part of the computer, and, they package this in a zip file, and this is is sold on cybercrime forums. And this is what we call well, and the cybercrime market calls stealer logs. Now this is rich with PII, passwords, domains, browser history, files sometimes that are, so they will take stuff that is small enough to be packaged but valuable. So really, like intelligence, like passwords, spreadsheets, text file, but they they won't go after, like, pictures, videos, or, binary files because it would blow up the zip size and it would be less convenient to to share a cell or also it would be more obvious when, there are large campaigns, you could see the traffic flow. So this is the TLDR for, Steeler log. Now this presentation, short presentation, is about what we found in, Steelers in in Steeler logs that shame that will shame, cyber criminals. So, malware operators. Okay? This was built by Estelle, and, she actually gave it at, Botconf, and, she won the whole like, she was best of show with the with these slides. And I propose to, reuse that content here because it's super fun. You'll you'll see. Now, the context about the the whole thing is, you know, the the you know reverse card. So, when you play you know, if you hit that card, then the thing goes backwards. So this is, you know, cyber criminals, infecting themselves or turning stealer logs against themselves where they should be selling or, you know, be successful. They got caught and we have lots of intel on them. So So that's the whole context here. So first up is Quinn. Quinn was found, infected via Redline. And, in the access, we found four cybercrime forums, access to 10 different stressor services. So a stressor service is a DDoS for hire basically. We found 10 suspicious, and malware IP addresses in it for panels, and we found two lists of brute forcing that they would they were using to compromise, servers and systems online. In the that bundle, we also found his Snapchat accounts, his, Epic, and his team, IDs and tokens. Now, we were able to, learn more about him or understand how he got infected beef beef, from his, browser history and his autofill. So because of that, we know that he was, trying to hack, trying to leverage a Fortnite skin checker, and this is how he got infected. So poor guy. So the the card was reversed on him. Yeah. Now, part of the payload, we had, like, his full name, date of birth. We know where he lives. And we see because of social media, we were able to pivot and find, like, where he went to driving school and, like, his real identity. So bridging a cybercriminal into, like, the real world, evidence. We also found his favorite porn star, the lugs there. So yeah. You Quinn, you should know better. Lesson number two. So OPSEC isn't included with a malware, toolkit. Right? So poor OPSEC will bite you, malware, mister bad guy. Next up is, x u, and, he was infected via a meta meta stealer, stealer. We found two cybercrime forums in there, five stressor services, rise proceed to IP addresses, and let's a stolen account in his thing. We can see you can't see it, but I can see that, the he got infected via a LinkedIn checker. So a checker is a tool that is used to validate if an account is valid or if a combination of username and password is valid or not. So these tools are being backdoored by other cyber criminals, so they have access to these machines. Good upset cyber criminals should use VMs when using tools that they they shouldn't necessarily trust. And these tools will often say in their read me or when you download them, you need to disable AV because it's a hacking tool. It will be flagged, but it's just false thing that they say in order to convince you to run it and be infected. So laced with malware, hit on them. And so with that, we found out he's a developer. Access to lots of development development tools, on his system. Okay? He has lots of different company names, company acronym, and access to a lot of males of different organization. So, basically, he's a consultant, leading medical equipment supplier, marketing, website building, more than a 150 administrative access to various organizations, more than a 140, IP address with admin, login credentials, and, three, three sets of reused credentials across 300 instances. Clearly someone who should be using a password manager, but that isn't. Disappointing. So combining all these together, we are dealing with a high privileged developer working with multiple organization. And he mixed his, like, dark side, you know, cybercrime life and his corporate life, reusing the same passwords across the two realms. Like, this is unbelievably bad upset. Like, at least you should know that you need to to do the separation here. Do not use the same password for everything. And can you believe this is Estelle's talk. Right? This is Estelle's slide. So lesson number three, don't cross the streams. One device for business and another for your bad decisions. And that's it for me. Thank you. Thank you. That was great. Alright. Hope everybody learned a little bit about stealer logs there. And next up, we're gonna wrap up with how not to become a victim of stealer logs. Andre, I invite you to the stage. And, yeah, wanna take it away? Yes. Sure. So it seems I'm the only one in my team brave enough to present without slides. So in my defense, when the alternative is AI generated slides, none feels like a better option. So quick question, maybe you can answer in the chat. Who here think info stealer victim are just careless people? Let me know what you think in the chat. Like, who imagined this a kind of, situation where grandma is clicking on the wrong pop up kind of thing? So this is what I thought before studying it, but I was wrong. And, I'll I'll let you know why and and what we discovered into our research. So we went through more than 10,000, steeder logs, and we're talking about real logs here. So that were sampled daily throughout the year 2025, out of flail's collection over, 175,000,000 logs, maybe more now. And the result kind of wreck the stereotype that I was imagining. So here is the first stat that I want to share with you, and it's the one that should make everyone in this room sit up. Okay? Eighty two percent of victims show the clear technical skills. So not the knew how to use Excel type of skills, actual technical skills. So the most common victims profile we found wasn't the the the naive user, but really the technical employee. So we're talking about, like, developer installs and unsigned open source tool and boom, got infected. So it's not a skill problem. And I will let the criminologist academic in me speak here. To have a victim, you need two elements. So structural exposure and behavioral predisposition. So the first structural exposure, according to our analysis, victims of Steeler Log spends way more time than the rest of the population on gaming site, entertainment, social media, and that's just where malware lives. And, so ad network, modding community, crack software portals, it's an ecosystem built for exactly this. The second element that is important here is the behavioral predisposition. When the, when, we compare info serial victim browsing habit to normal browsing baseline of the population, the victim screwed toward less mainstream or more impulsive corner of the web. So, quick click, low consideration, curiosity driven, and threat actor knows this. They're not exploiting stupidity. They're exploiting urgency and excitement. So click here to fix your printer right now, you know, this kind of of, advertisement. So the important thing that will make a victim a victim is that the structural exposure and the behavioral predisposition predisposition is present. So it's the combination. Really high risk environment plus impulsive click will equal compromise. That's the the actual formula. So let me share now, what, like, what we found in the data. We found that 21% of our sample share their computer. An example is a share family device. So one can one kids would download, Valorant skin changer, for example, and suddenly there's a log with 22,000 browser history, 17,000 cookies and over a thousand credential, including whatever mom and dad, saved there. And you can say it will yeah. Yeah. Credential leak rotate them, classic day for us in cybersecurity. But I will tell you why you should care about this. You should care because seventy two percent of infostela infection create organizational risk, even when the machine look personal. K? Almost sixty percent of victim had financial data exposed. Twenty six percent had direct access to company infrastructure. And this is not like a personal device, not our problem situation because third party infection, the Verizon DBR, DBIR, report already tell us that thirty percent of twenty twenty five breaches traces back to a third party infection. So this is a real problem. It is one of the big mechanism behind victimization. So what do you actually do with that information on a Wednesday afternoon? So I guess the message is stop treating awareness training like one size fit all. The classic don't click, onto this phishing in email, doesn't help the intern getting owned through the Discord modeling or things like that. So build scenario around the actual vectors, game cheat, crack software, printer fixed utilities, add chain redirect, get critical, credential off endpoint also and behind this. This is, the other tip. And, in false killer victim, aren't the the people you would bet on necessarily. So they are your developers, your exec, your inter little brothers. So like password manager, if I want to, do a little, a little reminder here, It is not a technology problem. It is a problem of understanding how human actually behave online. And now we actually have the data to prove it. So I hope it helps. Thank you. For the mute button again. There we go. Andron, thank you so. Nailed it. Dude, that was awesome. Everybody, that was two hours, a stack roster. Some of the best thread intel talk that you're gonna find anywhere. I got an absolute ton of value from it. Before I throw it over to Joe here, I wanna personally say a huge thanks to everyone who is on the panels, the entire Flare team. Joe, obviously, setting this up and running and amazing. And to you, the audience. Guys, I saw team SC come in full force and just kinda run roughshod all over the chat. And all the new people who I didn't know prior to this, it's great to meet you, and I look forward to continuing to partner with Flare. Joe, what did you think about the event, man? I'm floored just by the the turnout, the content, the passion, the engagement in the chat. Like, we put a lot of work into putting this together for everybody, and the last thing we wanna do is waste people's time. So, glad to see that that everybody enjoyed it. They found value. And, yeah, it was just all around amazing time. I had a blast. I love chatting with you, Jerry. And the researchers on our team and the support staff behind are, like, top notch. So proud to be a Flareon and in the community. Yeah. It was a great day. Beautiful day. Aces. If to use a volleyball term, absolute aces. Pure cinema. And by the way, I know it's absolute cinema, but I have an 11 year old and a 14 year old. So I say pure cinema because it makes them groan and cringe, and I love it. I haven't I haven't, come into the cinema. What do they call it? What the cool kids are doing these days hasn't. reached, my. Yeah. bubble yet. But, Jerry, I think, let's wrap up. That was it's absolutely unbelievable. So I wanna just let folks know where they can find us next. We have Hacker Week coming up in the city of Syn. Jerry will also be there, with a bunch of our researchers and and team. We'll be hosting a live panel with Anthropic, couple other, industry experts, and we're gonna follow the panel with a live CTF using our recently released Darkroom, which is a CTF training platform that's open to anybody. So really excited to get that out to the community and have people using it, learning with it, and encourage you to check it out if you haven't. And then after, we wrap up at Defcon Hacker Week, we're gonna be running a a CTF later in August with our friends at Wesus and Sands. So together with Wesus and Sands, we'll be hosting a CTF for anybody. Anybody's welcome to join. And, yeah, tell them Joe sent you if you end up coming. But huge thanks to our speakers, to you, Jerry, to all of, the support staff, and for everybody in attendance showing up and for fighting the good fight. So we'll see you next time. Peace. Still fishing for my mouse. There it is. See you, guys.