BSidesWarsaw track 2 dzień 1 cz 3

BSides Warsaw3:59:44212 viewsPublished 2024-07Watch on YouTube ↗

Show transcript [en]

- We also think about training for very technical people, even if it is also a matter of budget. We did something like that in the bank. Paula Januszkiewicz did these trainings for developers and administrators and they met with a very nice reception by the technicians, because it also opened their eyes to certain things, where there are potential risks, where there are errors, what consequences can be. In the bank it was possible to do it. because it is also a smaller company. In PepsiCo it is much more difficult, but we think about it. We have training for all employees, we also have training for those employees in the factory. I wanted to ask, you said earlier that

you had a zero-budget building for AOMS in your previous work. Now it looks better for your work. Better, yes. By the way, how big is your building that is taking up AOMS? 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10

people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10 people 10

employees of this office. They are being approached by the lawyers, the champions, the phishing simulations, the e-learning, the articles. We have employees in the factories and that's 200 000. But here it looks better. In the bank, we didn't have our own budget. The budget was in the training field. So we got money from them to do e-learning. And all other things we did with our own money. You can still find it on YouTube. I started doing it. It was a podcast about cybersecurity. It was called "Cybersecurity Window". It started to work quite well and even in the seventh episode, which I made after the showdown with Epsico, companies started to report that they would like to perform because it's cool.

But we did it totally free of charge. I took a set to record from a friend from the communication, I went with my private phone. I recorded it on my phone, put it on my computer and sent it to the bank to send it to the guy who did it for me. He gave me a run-up, a descent. Because I worked on TV, I was able to plan it so that I wouldn't cut it. So this element was lost and that's how we did it. And then they put it on the bank's YouTube channel. We had a podcast about cybersecurity done for free. The article could also be prepared for free because I just wrote it and sent it to the communication. But of course, if you have

money, you can do a lot more and more interesting things. There are also opportunities to attract attention. If there is an external company, an agency that prepares interesting graphics, has a cool idea, has creative people, it is much easier to do it than to create such graphics yourself. And there is no graphic sense yet. And did the money finally appear in this bank, which was zero? I know that there is a budget for it, but I know that phishing simulations are also done with their own tools, which they had for something else. Because it was not possible to find money external tools, which I think are much better. Because if you buy external tools for

phishing simulations, there are companies that specialize in it, they have a whole database of various phishing templates. You don't have to invent it, sometimes you just need to adjust it. They have a whole statistics expanded to it. They even have the possibility that you can send at the same level of difficulty, message to people who have clicked on it before. It works much better. Of course, you also asked about the team. In many companies, unfortunately, one or two people are responsible for awareness. And I have friends who are global awareness manager, but it's a global awareness manager who does everything himself. Of course he has an agency that helps him, but he has to handle everything himself. Advocates, simulation, learning, etc. You

can do it, but it will never be done well. And in the end, the person will be so busy that he will have enough. Teach, train and reward. What do you think about rewards? What are your experiences with this matter? I have a similar perception that people need to be rewarded. I do it. I wonder what happened to you. You know what? For example, for the month of Cybersecurity Awareness we came up with a game. If we have time. No, you know the prize in the books. We came up with a game and the prize was Harry's figures with a hacker. Bubblehead with HackerHare. Small ones. Yes, small ones. We sent them and it was for the winners who

had the most points for all weeks. For the people who had the top 5 in every week, they could choose. Slippers, backpacks, hats, organizers, etc. Sometimes this award can be a bonus to Amazon. People like it and use it. It can be sometimes what I was talking about, appreciation of the employee. Sometimes the reward can be that you send him a thank you email, that he will be highlighted on a global town hall, that this one and that one will prevent a catastrophe. Okay, the second question, because you have the slide written in English. We are talking about communicating certain content and from your experiences, - On the other hand, is there someone who is natively operating in Polish language?

Or is there a way to move towards multilingualism? You know what, I am of the opinion that materials in Polish language are better, I know it from people from communication, that materials that are in a language of a given employee, are the better way. But of course, now it is easier because we have AI. and there are already a lot of tools that help to translate the materials. You can even use ChatGPT, upload an article in English, translate and share. So materials that are in the language of a given employee usually have a higher clickability. But here's the budget again, right? Now, of course, AI can be used. It was much more difficult before, because you had to pay

the company to translate it. Unless you use lawyers for it. I have one at home. But thank you very much for the first two answers. And the third question, the last one. It looks like the idea with Harry was very successful. And now it's about the fact that you have certainly seen the potential for improvement. If you don't want to answer this question, I respect that. But what could have been done You know, we've improved. Exactly, so tell us about what was in the... First of all, this year we've released a new character. It's also part of the global organization and cultural diversity. So we've released Scarlett, the female. The idea was that the hacker defends the company against Scarlett, but it didn't work out. Because

it can't be that the female is evil and the guy is good. So Security Scarlet will deal with lawyers. The next stage is creating evil people, against whom Hacker Harry and Security Scarlet will defend the company. And here we have comics, movies, etc. Thank you very much. I have one last question. You said that if we don't fire the presidents from companies, we shouldn't fire employees because they were hired on phishing. I agree with the second one. Punishing an employee for hiring on malware, phishing, etc. is productive. However, I wonder if there would be no big educational dimension if once in a while an organization was recommended by a president who was not able to manage the psychics. It's not like it's all good and all good,

and then something magical happens. It's all about years of negligence at the management level, at the auditing level, at the pentest level. I think that this pedagogical mechanism of showing that someone in the organization is flying because it's a serious situation would send a very positive signal to the rest of the organization. Probably yes. I don't know if the president would fly or if CISO would fly. I don't have the experience of working in a country where it has changed. Probably somewhere, maybe it is, but it usually happens after some attack. I would like to live in a country where the minister who has a post on the public forum ends up being a minister

for 15 years. You're right. But how? - Thank you. - Can you put it in front of the closet? And here you have a magnet on the bottom to make it faster. - Take it in the corner, it will be easier. - And then plug it into the laptop. - Here we have USB 3. ok and the mouth is the same which cable should I connect? HDMI Oh, it's down here, okay. Okay, okay, it's there. No, because it was on the ground, you know, and it's already there. ... ... ... ... ... ... ...

Thank you.

What can we do? I'll wait another five minutes because we have to plug in the audio so that you can hear from the shirt, not from here, okay? I'm waiting.

I'll be right back. Something, something. How are you? OK, so what? Can we? Yes? OK, let's get started. Hello everyone, my name is Ścibur Sobieski. Ścibur is a name, not a double name. I would like to show you something that in my opinion is very underrated in cybersecurity. Fortunately, more and more articles on this topic are being published. I will also explain what made me interested in it. It will all come out in time. For clarity, you can interrupt me at any time. If someone has a question, you don't have to wait until the end. You can immediately say: "Listen, I have a question." You can also disagree with me. I have dozens of links to other studies on Zanadzha. We can

discuss these studies. And this is really the best way, because I want you to keep a little bit in your head if you have already come. You could watch a film on YouTube. I have mixed education, because I am an electronic technician, I like to solder, I am a math teacher, even a PhD student, but I have been doing IT for 30 years, I have finished coaching, and I beg you, please don't identify coaching with motivational speakers, OK? Click on the link if you don't know what is a sensible coaching, because it's such a nonsense if someone identifies it as not this one. And I actually performed various functions, also management functions, and during these functions

I got to me a little unwillingly, I was never trained in management, that it turns out that I have certain management skills and soft skills, but I lack in this regard of competence. I started to train myself in various fields, like Prince II, Agile, etc. I started to train myself in soft subjects, such as psychology. It turned out that it was a very interesting combination, because I was standing on two feet in two different worlds. You can talk to me calmly on the level of routable protocols, and at the same time calmly talk about, for example, heuristics in psychology. And this is something that is a bit underappreciated in companies. They treat it as a matter of competence to train a

specialist. And OK, he has a certificate of something. Take anything. I ask: "But is this specialist a human?" "But how?" "He is a human." I ask: "Do you look at him like a human?" "Don't you look at him like a..." I mean the element with a certificate, the certificate, but whether you look and see a human in it. From my point of view, a human is a very organic machine that works on electricity and chemical processes. Don't stick to this definition, it's my definition. Of course, if someone has suggestions to make it better, I'm happy to send a proposal. I don't have a problem, I'm happy to accept any suggestions. I want to talk about

it. I mean, that in all that we do on a daily basis, we are certain machines. If I were to ask you, on a daily basis, maybe someone wants to join, What drives us, what drives us on a daily basis, or what stops us? Do we have any proposals? Let's say the boss. Why are we going to the studio? To avoid going to the army. For example. Very good. Yes. Mom said yes. Why the hell did you come here? Because I have no automation. Also good. Yes? Why do we talk about it? Because, please note, each of us can have various motivations. And we think that we are in these motivations super healthy. And here we will make a short survey, I

hope you will turn it on. I just have to show it. I don't know if you know this tool, unfortunately, although we don't have more than 50 of them here. This tool was free until recently, and now it's paid, so I use it in the paid version. I mean, in the free version, sorry. You could scan this code. Now everyone is safe when they think about it. And think about it! If there are any questions from the room, could you repeat them? Yes, of course. Thank you. So, quickly, so you can scan them. Of course, those who feel like it, I encourage as much as possible, because here comes some statistical fun. Students like this tool very much. The university does

not want to pay for it. You know, everyone has their own. We had an SMS call. It was a call. No, forget it. I hope that this code will always be possible to enter on this page. And here we answer such a question. Of course, I will go straight to the next one, because there are three questions, so that we do not sit here forever. I pay a lot of attention to this. You don't like it. We could give five more answers here, of course. It's true, it can be complicated. You come to work and you think: "Damn, I'm so... " "No one drove me to the road, you know, I understand that for no reason." Yes,

I understand that. I have one question. Could you read the questions? Because if there are changes, the camera loses focus and every time it changes the camera. Sure. I'll read it right away. Here we have a limit of 50 people, so if too many people will report online, it's not that. I will go back to the first question. Is a human being rational? Especially when we are engineers, I assume that not everyone of us here has graduated from the University of Technology, but we work in the engineering department. And I, as a mathematician, always say: "You have to think about everything." I say: "Yes, thank you." Fortunately, someone said: "I know that I don't know anything, so I can quote

others." So yes, man is not rational, of course he is rational in different situations. If people were rational, they wouldn't get married. People, sorry. And it should be on both sides, not that the gentlemen here... No, no, no. The ladies would also show such healthy caution here. The second question was: "Do you always know why you don't like someone?" Of course, if I asked "do you like", It would be very similar, to make it clear. But here it was especially about a little bit to evoke a different way of thinking. And the third question was: "Did you happen to be angry for no reason?" So, what do you think is the common denominator of all these

three questions? Understanding one's own emotions. Just emotions. Listen, we are really terribly controlled by emotions. We think so much, but how? But I do everything rationally. I have such a professor, a great statistician, really documented by Robek, so that it is not. When he borrowed money in Pelikan, the entire Faculty of Mathematics was a bribe from him. He doesn't understand that there are any hundreds of them. For the sake of clarity, he knew how to calculate, but he didn't understand, he didn't try that what was on this contract, it has a life expectancy. Someone just screwed it in. And this, attention, why is it important? Is it his fault? A little bit. Because one could say that he doesn't use knowledge. A man, who was

already dead, had a very nice saying. I know it from his mouth. I don't know if anyone else has said it. He said that knowledge that is not used is shit knowledge. So you could say a little bit yes. If you know how to count percentages, if you know what equations are, then if you can't use it, So why do you need this knowledge? But that's what it is about. Here we would go into heuristics, into cognitive errors, into the halo effect, that someone likes someone. For example, here the ladies have much greater efficiency in twisting the gentleman around the finger. Now I'm not talking about marriage, I'm talking about various types of contracts. Marriage

is also a contract. and so on, and so on, and so on. Forgive me, sir, there is a bit of stereotyping here, but this is not an attack, we are talking about statistics, these are studies, so I am able to give a sense of what I am able to give studies on. And in fact, in all this we are, well, we, but what does "we" mean? Well, these chemical and biological entities. We are in a good place, in the Aula we are in the Department of Biology, there is chemistry, in general, a good place for this presentation. Let's go back to... Since we already know that these emotions occur, if we already know, then now, when you come back to this presentation somewhere, and

if we were asked what drives us, accelerates, stops us, then actually the only sensible answer would be "emotions". Because even this example that someone threw here, because there is air conditioning here, because it will be nicer for me, it is an emotion, right? Or I came today to have a day off from work. So that I could sit down and not be poisoned by the boss. It's an emotion. And we can come up with many other things like that. Exactly. How would we define a nightmare of a man from cyber-sex? What is it? What do you think? What could it be? We have an idea. Let yourself be taken for a fishing. One of the examples. And of course we can now give the whole list. So, pay

attention, such a banal thing. It happened to me recently, I teach among others, I advise and so on. I was walking between the classrooms, there is air conditioning in the classroom for lecturers, but not in the usual classroom, 30 degrees, wet as a rat. I still have to do the exams, so I went into the classroom, I logged in quickly on Teams to print the exam. I printed it, went to the classroom, passed the exam, two hours later the boys tell me: "You know what, you didn't log out of Teams." And now, pay attention, it's a simple thing, I know all the rules. Of course, fortunately, it was a meeting of lecturers, fortunately, no one did anything there, but it's a banal mistake. We, as people working with security,

don't have to be afraid of very serious mistakes. Because for these very serious mistakes, we are very much in favor of security, of course, if we have a budget for it, blah, blah, blah, blah, no, let's be calm. We often have to be afraid of these simple mistakes. So, in fact, what we are often afraid of are things that we will forget. And what do you think, if you said: "We are afraid of the attack, after the attack or before the attack, where are we most afraid of?" What do you think? After the attack. After the attack, okay. Because it has already materialized, right? So be careful. I think that in practice we can tell how bad it is and what

is happening. Because we are able to react to it. So now it will be a bit sexist again. Sorry, but it's really all very necessary. I separate it from the question of whether someone likes it or not. In the sense that we are not attacking anyone here. You go on a date, regardless of gender. You knew when to come, right? Adrian has a nose, Adrian has a nose. You go on a date. What do you think, where is the most pleasant for you? Before, during or after? It depends on whether the wife is going to be there. We are not talking about the wife, you go on a legal date. If it is successful, then after. It's just hypothetical. Damn, it's over, really?

Is it after? Then what do you think? When will it be next? Very often, it is very pleasant before. There are also studies on this. Because we live by the fact that it will be cool. This fulfillment itself, of course, it is very strong often, but it is very short-lived usually. Let's not develop the topic of fulfillment. Especially in the case of guys. But it's not that way. After there is a certain kind of relaxation, but not in the case of cyber security. because there we have this huge peak. But be careful, the phase before is very underrated, because we think that nothing is happening. However, in today's times, we are already moving to certain definitions, so

that we understand it better. I don't know why it would be double-edged here, it doesn't matter, I'll throw it out later. We have to clearly say what is behind it. There is the so-called stress behind it. And now let's try to define it, what is this stress? Because theoretically we think we all know: "The boss pissed me off, he stressed me out." Yes, that's true, but be careful, it is very important. Stress is the reaction of the body in the form of energy mobilization to overcome various difficulties, obstacles, barriers, regardless of whether I feel pleasant or unpleasant, this is very important. So if we go on a date, hence this analogy. It's about making it easy

to remember. If we go on a date, it's also stress. If we wait for an attack, it's also stress. Because it's mobilization. Don't tell me that you work in cybersec and don't wait for an attack. Because with an attack it is obvious that it is not a question of "if", but a question of "when". It's a bit like when we go on a date and we don't think

Will we get there? Maybe we will, but will that person be there? You know. I have no emotional load towards incidents. I will explain it in a moment. Very nice remark. You said that you had a feeling that these incidents were causing something in you, but now you don't have this feeling. No, absolutely not. In the case of a date, it is a emotional relationship, it is a bit irrational. Excitement is something that I do not have any emotions, no excitement, etc. Okay, I'll tell you about it in a moment. Yes, yes, yes, very good attention too. We know when the date will be. And pay attention to when the frustration on the morning grows, when we go there and someone is late, regardless of

gender. If you knew that the attack would happen tomorrow, and it would not be, the irritation would grow even more. However, answering a little, making a spoiler for the attention of a colleague, why we are not getting into incidents at the moment, among others because we are getting used to it. So we are able to get used to a certain level of stress. There are also studies on this, for example, if a person is watching a movie where blood is pouring, then watching another movie where blood is pouring, we say: "Blood is pouring, we move our arms". In short, there is an adaptation, And here it is normal, but note that it is not that we subconsciously do not feel stress at all. And what

is important, here I gave, of course, as usual, such examples, also to make it easy to remember. But the system is a stressor example. When we go back to the definition, it is mentioned that all these events that disturb our normal everyday life are called stressors. This is an important concept, because you can find it in many places. These are the situations that can cause stress. Attention! Because it is the reaction of the organism, for each person the stressor can have a different effect. So a friend could get used to incidents quite quickly and it flows down him like water after a proverbial duck, and someone else says: "Oh my God, when will the attack come?" Well, yes! And the other says: "Oh, when

will the attack come?" This is also a reaction, different. So one is scared, the other is happy. It's okay. When the pandemic started, my wife said: "Wow, it's nice that something is happening, because I'm getting bored and I live with you, because I always bring her entertainment there." So this is an example. The pandemic has just woken her up. So people react differently. And now, be careful, to sum up, we are all exposed to stressors at every step, for example, There are people who will come out here and say: "How am I supposed to talk to you?" So the tremor that will be associated with the speech will paralyze this person. It will not paralyze another person, because, for

example, another person has already got used to it. Or they just like to make fun of themselves and that's it. Some of you might say: "Geez, politicians are so stupid, they should have balls to talk like that." No, they just don't care about it. It's not stressful for them to talk lies. What is important? When we talk about stress, we talk about three types of stress: distress, which is negative in short, neutral stress and eustress, which is positive. So this is the level of stress that motivates us. And that's okay. Stress is needed. This is, among other things, an approach because I say, "Yes, let's remove all stress from life." We wouldn't do anything. We just need stress. but the individual dose is still

important for us. The individuality still depends on whether we slept well or not, whether we drank or not, and so on. So there are a million factors. It's not that we can measure it easily. And now to understand how it is, I will give you an example. Sorry, ladies, for stereotyping. I expected that there would be slightly more men in the room. I don't know if you go to the gym, but if you go to fitness, gym and so on, how do we feel after a light and short training, and how do we feel after a long, even light training? It's probably quite obvious that we feel more tired, because the muscles are tired. Well, we

also get tired when it comes to stress. So it's exactly as simple as that. As our muscles are tired, so is our stress muscle. That's how you can accept it. And here we come to something like chronic or overt stress. It is actually called the same. So if we talk about short-term, then for a while, and overt, it is one that will occur in time, but be careful, it can be moderate in the sleep. So waiting for an attack usually causes chronic stress. Because every day we come to work and think: "Hm, was it like that or not?" We sit down in the evening on the toilet, open the phone and the first thing we see are alerts: "No, okay, I can go to sleep." We wake

up at 4 a.m. and "Oh, there's an alert!" So we're always a little bit ready. I don't know if you know, I mean, you probably don't know that women, attention, are not, again, a test for it. They have an average of 25% higher cortisol, cortisol is a stress hormone, right after waking up than men. And we will say, but what about it? Well, first of all, it is because women suffer from stress a little more statistically, because they are already stressed by default. But note, it is very biological. Because when a woman statistically wakes up in the morning, what does she do? No, a diaper, something, etc. And biology constructed it this way. And we can of

course be offended by it, but I'm sorry, I won't give birth to a child. Again, it's not that we are equal in the meaning of biology, we are equal in the meaning of rights. In the ideal world. We are not at the lecture on the law, I am talking about the ideal world. Yes, yes, and of course, and individual differences also include this. However, I am talking about statistics. Why do we talk about it? Because we can not notice this chronic stress. That's what we get used to. We don't even realize that we have this stress all the time. It's a bit like Marcin said about the frog cooking. If we will successfully raise this stress every day, we don't even realize that this stress

is accumulating. Moving on, we have to speed up a lot, it can result in various reactions, such as constant fear, anxiety, waking up at night, frustration, irritability, feeling of hopelessness. being defeated, I wake up and say: "Oh, my dear, the world is useless, I'm not worth anything, let civilization end." This is actually a stress effect, such a speech. But what is important for us from the point of view of cyber security? Concentration disorders, memory, decision-making, cognitive processes, feeling of helplessness, thinking, emptiness in the head, gaps in memory, fogging up of the message. Is it easy to remove the incident then? Well, not really. Of course, you have a lot of information on these slides to read

later. So, what can be the sources of stress in the case of cybersec? We are already doing this function. Well, the question is: will they attack me? We talked about it. If they attack me, then I haven't forgotten about something, I haven't thought about it. Why can't I sleep? Have I made these corrections with the last regression? I don't have any problems with such actions, but I had to use Workaround if I didn't raise it. So, did I secure everything? Did I do everything right? Or how many times did I tell my boss about buying new licenses? And so on, and so on, and so on. These are the usual sources that we have at work. It's normal, but it's not the end. And what are the

sources of stress outside? Let's assume that we don't get married, because usually, even if we get married, it's not too often in life. We also said that it is stress, but we often have things like: loss of work, increase in credit, family illness and all the others. And these are stressors. And we have one muscle - the stressor. And here we come to the point that we are not, we have to start looking at ourselves not as an employee, mother, father, son, someone else, but I'm just one person who is supposed to carry all of this. No matter where I am. Once, a security guy came to me during a coaching session, who came with the idea that maybe he would like to change his

career path. Let's leave the description of why he had such a... because it's not important at all. Listen, It turned out that after 15 minutes of conversation, the guys were snoring for the rest of the standard session of an hour and a half. But why? Because it turned out that he was a victim of domestic violence. His wife was beating him, including beating. It can touch anyone. Yes, statistically, it is rarer in the case of a woman to a man than a man to a woman. It's true, statistically. But a guy came. Why? Because he couldn't stand at home and wanted to relieve himself of stress at work. He wanted to reduce stress at work, so that he could bear the stress at home.

We are not robots, right? That's what it's about. And if we sometimes have such thoughts that we need to change the job, then maybe we need to change it. But maybe we need to remodel our whole life. Maybe we need to look at ourselves differently. And it would seem that a cool, handsome guy comes, well-built, and I say: Of course it's not about violence, but she says: "You can't defend yourself?" And I say: "I can't even defend myself because it's a woman." And of course she won't do him any physical harm, but listen, it's nice. So why am I saying this? Because often in companies there is this work-life balance. This is the most common marketing buzzword. Often in companies it comes down

to having such a slum at home so that you can squeeze the maximum out of your work. And of course I understand the employer, this is normal, it is not that what they do is abnormal. The point is that it is sometimes impossible to do it that way. I mean, we are, each of us has an individual level of endurance for this stress. This is not only personal, but also seasonal. It can be different in winter, in summer, at this time of year, in another, etc. We must look at ourselves holistically. As a curiosity of research, what do big companies say? In 2020, almost 95% of CISO was processed. Listen, we're not talking about 10%, we're talking about almost

100%. 90% would agree to a discount on salaries if it meant less stress. Well, you won't tell me that's not enough, right? In 2020, IBM, which is probably not such a very anonymous and small company, I think, that 81% of respondents noticed that ransomware attacks have sharpened the psychological requirements of the groups. These groups must have greater mental resistance, so they must be more prepared for these attacks. 60% of surveyed teams of incident response, i.e. IRs, have found that they are often divided into two or more incidents at once. Are you able to effectively eliminate two incidents at once? 67% saw negative effects of their work in their personal life. This is obvious. Look at this brutal example of a guy who has a very bad home.

He transfers it to work, but it is the opposite. If we have an incident at work, we will be uncomfortable at home. This is how it works. Most respondents turned to help in the field of mental health due to the experience associated with reacting to cyberattacks. So they went to a psychotherapist or psychologist and said: "Help me!" Or a psychologist, of course, and said: "Help me, because I don't know how to manage myself." Research by another company, TREAT Connect, 27% of the reasons for the rotation of employees were attributed to stress. and 74% of CISO said that the workers left because of stress. I'm curious if 5% of those who are not overworked are not just workaholics. You know what,

I don't know how it is, to make it clear, and what I'm doing now is my frivolous hypothesis, which I can't confirm. for many reasons, but generally speaking, there are quite a few psychopaths on very high positions. Psychologically, psychopaths. Those who are really psychopaths. And they deal with emotions completely differently. So it can be like that, but that's just my opinion. So what should we do if we talk about an attack? If we recognize, as you will read later, the various symptoms associated with this stress, It's worth preparing for this daily attack. I'm talking about myself, not only about the firewall, not only about updating updates, not only about making corrections, not only about turning

on the appropriate mechanisms that you know about, probably some of you know much more than me, because I'm not only dealing with these technical aspects, but also to play a bit of this programming in myself, to make an update of my software and hardware. Of course, there are good conditions for social functioning, for example, not to argue, the atmosphere at home, etc. Healthy lifestyle. And here we have what we laugh about most often. We say: "Oh, diet, so you have to eat vegetables." And I don't know what you should eat, because it's individual again. It's not like everyone has vegetables alone. There are people who eat raw vegetables badly. I would be doing lectures on this topic again. I am not a dietician, don't ask me about

it. Avoiding food, there is a lot of research on this. I will tell you a little later. Physical activity, good sleep, the right proportions between science and work, etc. When someone comes to me for coaching and asks: "I would like to talk, work on work-life balance", my first question is: "What is work-life balance for you?" And usually two sessions we go to define what work-life balance is for this person. We have no idea. We think that 8 hours of work, 8 hours at home and 8 hours of sleep. No, no, no, it's nonsense. Everyone has their own individual needs and must look at it from themselves. Good communication with people, of course. What is important?

Observe yourself and see what is happening in you. So read, verify, but check what works for you. Because you have a bit of individual operating systems. It's not like you have FreeBSD or Linux. Of course, it's a distribution. But you have your own system. And you are the only expert on your own. In fact, there are no experts. Others can only tell you what to pay attention to. And of course, you can try out various things. I would like to point out that it is not a good method to start with, and there are studies on it, if you do not exercise too much, to immediately start to put on a very heavy weight. Because a very heavy sport performance is also stressful, i.e. it affects you as much

as it does. Therefore, it is not the right way, it must be step by step. And what is very important, the only correct method is not developed at the moment. Mindfulness, meditation, yoga, qigong, and many other things work. You have to get used to it. Why is preparation important? Why do you train before competitions? Your head is your weapon. Okay, but what did I want? Because so far we have been saying a little bit, pay attention, we work with our head. I mean, the fingers are performative, but we work with the head. How do you think, what is this body for the head? I will speed up a bit. The body is on the one hand a housing, it protects our brain,

it is a vehicle, because we can move, but it is also a firewall and a battery. So, for example, I don't know if you know, our skin is a brilliant protection against a lot of bacteria and viruses. If we have, for example, injuries or we don't take care of this skin, we may get infected. If we get infected, our body will weaken. It's simple. For example, almonds. Or when we inhale, for example, I don't know if you know, but when there was a pandemic, there were two things that were brilliant in the pandemic. Paradoxically, we were very defensive of them. Handwashing and masks. It's not about the pandemic, it's about the flu. It helped brilliantly in lowering the chance of getting sick from the flu. And

I think, my opinion is that we should do everything to make these handwashing devices stay everywhere. I know, and this is one of the biggest stupidities. For example, I have a print that if I enter and there is such a camera, I just wash my hands. I also washed my hands before the pandemic, but let's leave it. And I'm not a fan of cleanliness, to make it clear. But it's just that this is a factor that helps us a lot in removing what gets into our body. And the battery? Well, what we eat, how we eat, how our body functions causes consumption. Do you know how much energy the brain consumes from the body? More like percent,

right? It is 20 to 30 percent of the whole energy of the body, which is the brain. What is very important? I also mentioned that we need to take care of our sleep. Attention! This is very interesting. Such research was conducted, because it was said that we should take care of our sleep, sleep 7-9 hours, but what is important? The effects of insomnia are of course sleepiness. Okay, it's trivial, but attention, irritation, problems with concentration. According to statistics, 5% of the cases of communicational disorders are caused by drivers who fall asleep behind the wheel. It is estimated that this is highly underestimated. But what about severe long-term insomnia? Nerve damage, inability, heart attack, stroke, causes diabetes, obesity,

depression, indigestion, menstruation, menopause, etc. So what? If we have everything here, what do you think, if we don't sleep, it won't affect our effectiveness during cyber attack? It will. It's not the end. Yes, yes, yes. Well, some studies have shown that after 17 hours without sleep, our sensitivity drops to a level of half a pramil. No? After a day without sleep we get a state of 0.8-1 promille. That's why there are communication accidents as a result of insomnia. Note that the alcohol test won't detect it. Right? Right? Right. When we are talking about alcohol, it's worth mentioning that 0.5 promille distracts our attention. Attention! I used it for many years, I admit it's a very bad technique. When I was very tired

in the evening and I wanted to do something else, what did I do? Coffee. No? Drineczka! You don't do that? No? No, you are holy, I know. Why does Drineczek help? Because it expands blood vessels and causes better blood circulation for a moment of the brain. And it really helps for a moment, but after 30 minutes there is a ass. And another one, right? It's hard later. So, be careful, 0.8 promille, according to studies, causes excessive excitement, reduces coordination, but attention, it significantly reduces criticism. What does it mean? Critical thinking. Do you want to make important decisions then? If we have a mile or more, then we have such, well, it is known that there is a balance

disorder, Adrian, you can test yourself on Adrian's equipment, how the balance disorder works, but logical thinking, delayed reaction time, as well as aggression and deadly, dangerous bravura. And what do we do then? RMF through a return? And we say: "Ah, we can handle it from the back up!" Yes? We would be inclined to say: "Oh, they attacked us, so let's clean the system first". Everything is from the backup. And then: "Oh, the backup was, but never checked, it doesn't work". This is completely beyond that. The most murders in Poland, there are statistics on it, is after alcohol. Of these murders, the most is in the family. Test of the son, test of the father, etc. It's on the side, but it's the influence,

among other things. Aggression and bravura. It takes away the brakes. I don't know if you know that alcohol is the strongest aphrodisiac. It takes away the brakes. That's what the research is for. And be careful. I'm not talking about such hardcore drugs. Let's say that it's illegal in Poland. Marijuana is also illegal. But, okay. If someone said Telegram, we can handle it. However, there are studies that it can cause anxiety. I know a case of a man who landed after three marijuana burns on a schizophrenic treatment. They get normal schizophrenia. It happens. You have to have a damaged gene to get it to happen, but it is. And family obesity. But attention! We don't deal with stress. We have mood

swings. We have sleep disorders. Of course, we are not talking about a single joint, we are talking about the fact that it is simply a practice. The dependence on substances with a higher potential increases, i.e. it causes us to take something else later. And the increase in body mass also. Then we have another thing that is also very popular at the moment, although legal. It is called obesity. Yes, I also have 8 kilos too much at the moment. But fortunately, it's not a backache. What does it cause? We're talking about a really big backache. Asthma. What causes asthma? It's hard to sleep. We talked about sleep, right? Day-to-night, a cause-effect relationship. A group of insomnia, that is, we sleep and... So what?

We won't wake up? When we wake up, we don't have this nice sleep. If we don't have sleep, we don't regenerate. depression, anxiety disorders, emotional ones, etc. We have kidney diseases, etc. In short, we come to the conclusion that if we want our brain to be a sensible tool for our work, we have to take care of its packaging, which is the body. And this is a bit like, you know, they came and fucked about what we all know, i.e. movement, but again there are studies on it. And you may not do it, so to speak, life, right? Who would forbid us? However, there are many studies that the movement, while again reasonable for a given

person, for example, intensive marches, marches are much better than running runs, Yoga is much better than going to the gym and doing 150 kg on the bench. All of this must be transferred to your body. This is an improvement of mood, learning ability, brain efficiency, improves self-esteem, reduces stress. Why? Because oxygen dissolves cortisol. The only solvent of cortisol is oxygen. So if we have better circulation in the body, we have better blood circulation and then cortisol dissolves. We strengthen the immune system, so we are more resistant to diseases, improve sleep quality, rest, and so on. There are a lot of things for that. To sum up, I wanted to add a bit, of course, if someone has

any questions, we will go back and I will answer. I wanted to add a bit to the previous session. We have to approach it in such a way that we are a kind of knight or knightess, or I don't know what to call it, on the occasion of the others. I'm sorry, but I haven't learned how to change it yet. We have to take care of our weapons and our brains, both our body and our brain. What is really important, and remember this, is that I teach psychology for IT at universities and companies, where I teach people that it's not like psychology bites. And that you can really, especially in neurobiology, which is very interesting, you

can draw incredibly cool things for yourself. What is very important, and remember this, we must observe ourselves. So we don't do something like a friend said that we go to the gym and there are 150 and he is this, and we are there: help, because we are not able to. This is not the method at all. You just have to look at yourself, read what different people suggest. and to choose what you want. I don't like yoga, but I like tai chi. I've been practicing for many years and it's a very good activity for me. But for me. Do what you want. It's worth reading the research on body and brain servicing, because it's changing, there are more and more researches.

The researches that are very strong are about meditation. This research can be found in many sources, how meditation helps to calm down and improve concentration. We are talking about a meditation that is chosen for us. Even people who do meditation say that if you sit in front of a wall and meditate in this way, it may turn out to be one of the worst forms for you. So it can also be chosen per person. You have some bibliography, if you want to reach out to me, I can show you some of the researches, including those of Abiemoski. If you want to see some of the CISO, I can show you some of them. Of course, I didn't give you the whole literature,

there are dozens of them. If you are interested, you can send me something. You also have Google, so you can't look for anything. If you need something, I can't hide my name and surname combination, which has its advantages, so you can find me on different Facebook pages, you can email me if you need anything. I cordially invite you. Any questions? First of all, absolutely fantastic for the audience. No, no. Thanks for the question about how companies approach this. I will answer this way: they approach it in many different ways. I know companies that I didn't put the link but it just appeared this morning when I read it. There is a portal called "Magazyn Pismo" and it is about how another

corporate buzzword was made from well-being and mindfulness. It is about pushing us as much as possible, like from a lemon, to be the most efficient. If this is the approach from the company, it is not quite cool. There are companies that have it totally somewhere. Often it is, as Marcin said, small business. If someone has the name Janusz, I do not offend, but it was accepted, sorry. There are such Janusz businesses who just and we won't do anything there. But this awareness is growing all the time and I'm happy about something else, that this awareness of people is growing a bit thanks to this type of performances like mine, among others, because I'm not the only one. Because in fact, it's about you having to take

care of yourself. And of course, you can persuade the company to train me, for example. But the point is that at the end of the day, It is important that there is no such thing as "ha ha ha, what a fucker" in this training. Because you are hurting yourself again, not me. Because someone paid me for this training anyway. I see that when people come to me individually, for example in coaching or mentoring, I see that there is a greater need to look at myself holistically. It's a bit like the very brutal extreme example I gave. Fortunately, there is only one example so far. One of them was extreme violence in my home. But people who are burned

come to me in tens of years. It is obvious that they will not serve a few dozen people per month. There is no such option. A girl came to me and said: "Let's leave it". She has two children and a supporting husband. A wonderful story. She can do whatever she wants, but she said that the case would turn into IT. I looked at her a little bit, but I said: "Okay, let it be. Our client, sir, my goal is to recognize and help you, not to judge." And finally, to sum up, I have to make a link, I mean, an entry on LinkedIn on this topic. And to sum up, it's the best. I thought I had to develop, because

I was told that I had to develop, and it turned out that it was enough to get enough sleep. And this is the quintessence. Often we are told, regardless of our gender, and this was an example with a lady, but regardless of our gender, we are told that we have to develop. And you know, I have such an approach that it is a bit like a roll of toilet paper. If you develop, you know what will happen at the end, right? You have to grow. I really like the English word "grow". There is no good equivalent in Polish. It's completely different. Grow. You have to grow. And to grow, you have to root well. And

when people start to look at themselves like that, it's a place to work. And teams also start to look at this topic. It depends a lot on the company. A bit of digression, but... Anyone else? Excuse me? Yes, please, go ahead. Yes. Yes. The question was from the audience: is it worth using technology to recognize our state of fatigue and many other things? Yes, from the company's point of view.

The answer to this is again not simple. The answer is a bit like this: it depends. Why does it depend? Again, very briefly, because we could talk for a long time. The situation is as follows: is the knife good or bad? If we cut bread, it is good, if I cut the heart of the enemy into a living one, it is good too. Well, I see men like it here, not everyone likes it, right? And why am I saying this? I am absolutely for it, unfortunately, Adrian is not here, because he is just a biometrist. This is the power of biometrics, to be behavioral, to detect that my state is such that I should not, for example, once my friend wrote a script that detected

certain behaviors on his keyboard and did not allow him to log in to the root, because he simply had a tendency to be after a liter of alcohol at 3 in the morning. And because he did too much on this route, he wrote a script that detects him that when he logs in wrongly on this route, you know, right? So, of course, the most behavioral ones, I am absolutely for introducing such tools, but attention, very strongly together with this type of things, so that a person understands what it is for. And there is one condition that the company cannot use it against a person. It can't be like "you are tired for the third time

in a month, so we will replace you with another employee". Such approach is just punishable. But there can always be something in the background, for example, the extreme case I mentioned. So, in response, I am for such tools. Even recently I had an idea to write a project for and behavioral behavior to detect various incidents. I will not describe it broadly. It turned out that there is already a Polish company that does such things. So I was still wondering if it was worth it. Yes, tools as much as possible, but together with education. Anything else? Contact in case of need. I thank you. Unfortunately, I will not stay with you next year, but tomorrow I

have a session live in the morning. I mean, with students. So I have to go back to Wrocław. Thanks. Hi, hi. I'm going. There is a microphone. I just drove, you see. Now the sound works nicely. What are you doing with it? He gave it back. I don't know if you can hear me. Yes, you can hear me. So, as a representative of the 1753C Foundation, we are an association, we operate in Katowice, Gliwice, and generally in Silesia, but we also plan to start some meetings in Warsaw. We meet once a month, we talk about interesting things, mainly about offensive cybersecurity. We also do training for children, we teach 9-year-olds how to use Scalia, we cover security

in Google, watch YouTube and other interesting things. Parents seem to agree on this. There is a so-called cover for it. We also have a Discord channel, or basically a server on Discord. We have a YouTube channel, where part of our presentations are posted. In the meantime, I work at ING Hubs as a red teamer and pentester. Disclaimer. Disclaimer because what we will show is illegal. Illegal not only in Poland, but also in the European Union. When I showed it at one of the conferences, after the conference, after the presentation, the prosecutor came and said that there are different paragraphs and you can get up to five years for such things in Poland. Generally, you can get five years for showing hacking. This is how the Polish law says that

showing how to hack is a help. Nothing else than a help. So, in order not to fall under the paragraphs, what we will do here today are scientific studies. If someone disagrees with the subject of scientific studies, then he must enter. I said that this presentation is related to CO2, that is, it was shown once to reduce CO2, so today you are the fifth audience to see this presentation. I wonder how much we will achieve this year. Okay, why are we talking about this GPS? We are talking about GPS because in December 2023, most of you probably noticed in the media such headlines, topics that Russians are attacking GPS in Poland. There was even quite a lot of truth in this, because it turned out that

in the Kaliningrad district, now it should be called the Królewiecki district, there are indeed some antennas that are interrupting the GPS signal over the Baltic and over part of Poland. And so, deepening this topic, I came to the conclusion that I can say something more about it. This is what the yesterday's map of the noise was like. You can see it live on the website gsjam.org. This map shows the Middle East and Europe. For example, the red dots at the top are the area of St. Petersburg. There, the Russians are actively disrupting the GPS so that oil installations, such as the port and the city of Petersburg, do not become the target of Ukrainian drones. Ukrainians have quite a large number of such drones,

large drones, such small planes, which, based on GPS signals, are able to reach and break through in a planned place. So the Russians are making a dome over strategic places in order to prevent the GPS from showing real information. The Krulewiecki route, which we were talking about earlier, is no longer a source of disturbance. The Russians have already carried out the exercises they were supposed to do, they have seen how NATO services react to this type of to this type of incident, they saw how civil services react, because in fact most of the problems that are related to this GPS interference are problems for civilians. The army has certain technologies, which we will talk about later, which are able to bypass, so to say, some

types of interference. Moscow is also protected by a parasol of GPS interference, so that it would not become the target of an attack or that the attack would be more difficult to carry out. What else? Israel. Israel also, over its entire territory and in the area, is interrupting the GPS signal. It's so strange that it doesn't make much sense, because if someone wanted to attack Israel, and probably someone from the gas zone would want to shoot some rockets, or some Vatashkivs in the area, their rockets would probably be like dams. They would not be rockets whose accuracy would be measurable in any way. So they protect themselves from a little bit of a fictional threat from Iran, for example. So if Iran wanted to attack them, if

they wanted to use some more intelligent missiles to attack them, then they would be protected. But the balance in the Middle East, although fragile, is rather at such a level that neither Israel nor Iran will attack Israel. What we are going to talk about is generally called GNSS systems, i.e. global navigation systems. There are a lot of these navigation systems. The fact that one of them is GPS, it is simply the GPS that has been most connected to our consciousness. But we have a lot of these systems. We have the American GPS, we have Russian GLONASS, we have Chinese BeiDou, we have European Galileo, we have Japanese systems. Generally speaking, India has its own system. These four systems,

which are generally referred to as global systems, are systems that operate all over the world. These satellites that are fired, that send signals to the Earth, operate all over the world. Regardless of which part of the globe we are in, we are able to determine our location on the basis of these four systems or each of them separately. What was the history? The history of GPS is interesting because no one planned to invent such a system. This system was created by chance, by accident, you could say. The United States was a bit surprised that the Russians, or the USSR in those days, won the space race and sent the first artificial satellite into orbit. This happened on October 4, 1957. Then the American army, the American scientists, said that

they did not know what the Russians were going to do with such an artificial satellite. Where is it circling? What is it doing? It was known that this satellite was transmitting a signal to the Earth at a certain frequency. The task of the Americans was to build any tracking system of this satellite in a very short time. So that it is possible to determine the position of an object in space that gives this signal based on the signal that comes from space to Earth. It turns out that it is quite easy to do. because there is something like Doppler effect. Doppler effect, if we have three variables, i.e. the place of sending the signal, the

frequency, i.e. on the basis of the frequency, we can calculate the time of reaching the signal's ground and the place of receiving the signal, is able to precisely calculate any of them from these three variables. So if one of them is unknown, then having two others, we are able to calculate the third one in a fairly precise way. So if we know where we are receiving this signal on Earth, if we know this frequency, we are able to get the common ground in space after quite simple calculations, from where this signal comes from. And that's how the Americans started tracking not only the Sputnik, because it turned out that in a moment other objects that appeared in this space appeared. The

first idea to use it in the opposite direction was the Transit system. Transit system, that is, a military system only for military use, was commissioned to conceptual works in the 1960s, which was to apply the Doppler effect in the Sputnik, but on the other side. So we have some satellites that send a signal, and we are able to calculate more or less where we are on Earth on the basis of the signal received from these satellites. So exactly how today's GPS works. With the exception that the transit had an approximate accuracy of 500-600 meters. So we knew more or less where we were, but it was not as accurate as today. In the early 1970s, the US Department of Defense stated that this transit

is inaccurate, that it needs to be improved a bit. And then the work with GPS started, the one we know today. The first satellite was launched quite quickly, in 1978, NAVSTAR-1. Generally, in order to achieve the ability of the entire system, that is, to cover the entire Earth's globe, almost the entire one, because there are problems on the continents, you need 24 satellites. Today we talk about shooting satellites so much. We have Elon Musk, we have rockets of multiple uses. Sending satellites into space or into orbit is not that expensive at all. If we all gathered here together, maybe after 40 years of postponement we would be able to send a few kilos into space. But it was not

so cheap. Sending satellites was very expensive. Not only were the rockets disposable, but it was not a technology that could be transported to orbit every day. So, in fact, the full operationality of this system was only in 1995, so for several years these 24 satellites were shot. An interesting fact is that these satellites, I will tell you about it in a moment, but satellites do not fly in one orbit, they fly in different orbits. This system is generally thought through in an interesting way. And then there was a certain event in 1983. In 1983, the South Korean aircraft of the Air Force violated the airspace of the Soviet Union. It violated it because it did not have any device

on board that would be able to provide the exact location of the aircraft and the pilot flew 20 km into the airspace of the USSR. The USSR did not ask in those days. If someone broke their airspace, and was from a country that was not a friend of the Soviet Union, South Korea was not, it was shot down. And so Russian MIGs or Soviet MIGs shot down a plane full of passengers. This caused outrage in the world and the American President Ronald Reagan decided then that this military technology to be accessible to civilians. Since 1983, we can talk about the civilian use of the GPS system. Until 2000, the civilian GPS system was not very accurate. The Americans were afraid that a system that is

generally given to humanity, because everyone on Earth could use it, these receivers are passive receivers, so we don't know who uses this signal, they were afraid that such free access to precise location It can be a threat for them, because the Russians can use it. Until 2000, additional noise was added to the modulated signal sent from the satellite. This noise was called Selective Availability and caused a disruption of about 100-200 meters. Our location was more or less up to 100-200 meters. In reality, it did not work that way, because it turned out that these devices are so precise that they are able to cope with this added noise and the error of the location dropped more

or less to 30 meters. But it was not as accurate as it is today. An interesting fact is that the GPS system has a kill switch. Americans have kill switches that can turn off the GPS signal in any region of the world. So they can say that Europe has no access to GPS signals. Besides, the fact that there is a kill switch in GPS technology was the driving force behind the creation of other technologies: Russian GLONASS, Chinese BAIDU, or Galileo in the European Union. The second curiosity: on September 11, 2001, the attacks on the World Trade Center, George W. Bush was wondering whether to turn off the civilian GPS, whether due to these attacks, fearing further attacks that may

take place in the United States, were wondering whether to not turn off the GPS, just not to turn it off globally for civilians, so that the planes would stop using it and the possible terrorists would have a harder time getting into a specific building. This did not happen, but there was such a threat. What I have already said, such a summary, a little tip. It is a system with a global range, one of the few, one of the four in fact, it uses six orbits, at least four satellites are on each orbit. Why at least? Because there are a little more satellites than 24 today. These 24 are needed for the system to work. But in fact, an excessive amount is fired

in case of a satellite failure. Satellites are volatile, and the Americans are increasingly are increasingly afraid of anti-satellite weapons. For example, weapons that Russia could have in space, which the Russians would be able to shoot down other satellites. So, having a large constellation of satellites, they are then able to replace these points with something else at a single point of failure. Accuracy. Today, accuracy is quite high. Besides, the GPS system supports some additional technologies, some sub-versions of GPS, including D-GPS. D-GPS is used when we want to have a really precise location, up to centimeters. It is used, for example, in Europe in agriculture. If we know the exact location of a certain point, the exact location of a point,

we can fix the device that reads the GPS at this point. And then we will see what is the mistake between what we get from the satellite and the actual location of this point. And knowing this error, we are able to make this difference for future readings. If we know that the edge of our field, which a tractor is supposed to drive, has exactly this location, here we fix the GPS location, we see that the shift is 5 meters and to each next location read from the GPS, this signal from the cosmos, we add this correction read at the beginning. Thanks to this, we have a very precise possibility of locating our location in a very narrow area, but most often sufficient.

These are actually centimeters. Geodeci use intelligent tractors, because today, to plow the field, you don't need a farmer, you just need an intelligent tractor. They can use our autonomous mower. There are mowers that mow our garden based on GPS signals. You don't need a rope dug along the fence. They also have lanterns. There are also lanterns, but an aerobot also has a lantern and it goes wherever it wants. But in general, we will talk about it in a moment, or at the end, that it is good to use many technologies. For example, a lantern or a rope somewhere under the fence is an additional defense method, an additional point according to which we can determine our location. Free of charge. Everyone can use GPS

today. You just need to buy a device. There is no license for it, nothing. It's a bit strange because everything is in subscription today, but GPS is free. Tri-dimensional positioning. With the visibility of four satellites, the fifth is sometimes useful, but at least four satellites, we are able to determine our location not only in 2D, the height and geographical width, but also the height above sea level. This is so useful that thanks to it, even the Himalayans are able to check exactly whether they were at the top or not, having some GPS trackers with them. Because very often someone announces that he entered the summit, and it turned out that the summit was a meter

higher, because there is still some other summit on which someone did not enter. And a very interesting thing: GPS works based on time. In GPS technology, it is very important to know the time, minute, second and a few places after the comma, when the signal was given and when it was taken. So in the entire GPS protocol, we have the function of universal time. This function is one of those that were often attacked. Many organizations relied on their time servers for the time read from the GPS. Today, you can meet industrial controllers that have support for setting the time in the NTP server from the GPS signal. The stock exchange in London once had the time

of the stock exchange based on the time of the satellite. One attack was carried out on the stock exchange in London. The attack was that someone spoofed the time and first sold the shares, then bought them. I had a zero wallet, but thanks to the fact that I could make a journey to the future and then return to the past, I was able to attack the stock exchange in London precisely because it manipulated the time of the stock exchange operation. Passive technology, as I said, anyone who has a receiver is able to read the signal. This is how GPS works. This is the graphics that come from the official website. of GPS technology in the US Department of Defense. You should not be attached to

the physics that is here, because this is American physics. This is not real physics, these are some contradictions. I think that at UW you perceive the speed of light differently and the speed of the radiation wave, but less so. The general rule is that if our receiver will receive a signal from the satellite. And our receiver knows where this satellite is in space, because it has such information somewhere. And it knows when this signal was given and it knows when it was taken away. It is able to determine its position. This is the magic of GPS. This is a few mathematical calculations, really. We need to know where the satellites are at a given moment. And if we are able to and receive a

signal from them, in which the information is encoded, when it was given, then we are able to calculate our position. Now there will be some boring things, namely what the frequencies on which these waves operate look like and, among others, We can see how it looks for GPS. GPS has three different channels: L1, L2 and L5. Three different channels, two used normally, i.e. L1 and L2, used both in military and civilian technologies, and the so-called rescue channel L5. This is a special channel dedicated to rescue services, but anyone can also use this channel. As you can see, the frequencies are not easy to remember, but as it will turn out in a moment, they are easy to calculate. We also have European Galileo, we have Chinese Baidu and

we have GLONASS. In general, the idea of the operation of these other systems is exactly the same as the idea of the operation of GPS. How can we calculate these frequencies? It turns out that the base frequency of this wave is 1023 MHz each time. And now we take a different multiplier only depending on the channel. If we want to calculate the channel 1, our multiplier is 154. 154 times the base frequency equals the frequency of channel 1. L2 is 120, L5 is 115. Someone here has made a good effort to come up with such a scheme, but thanks to this, you can add a few equations. What do these channels mean? You can see that

there are some notes on them. What do they mean? It turns out that these notes are nothing more than a so-called pseudo-loss code. On each of these channels, these channels are binary, i.e. 0 and 1 are given to them, which flow to us from space. The pseudo-final code CA, which appears on both channels L1 and L2, is nothing more than information that we can use to determine its location. The time of the signal is given there, and we calculate the time of the signal. Based only on the CA, we are able to determine our location up to 20-30 meters. That is quite tolerable, but with such a car navigation, 20-30 meters is very important. The P-channel is a precision channel, or the P-code is

a precision code. A precision code that can be used only by precision systems. Precision systems in the American or military nomenclature. Only the United States and NATO allies have access to the precision channel. The precision channel is already a channel in which on this pseudo-loss code, simply encrypted. You need to have a key with which we can read this information. Standard systems are those that we normally have in civilian applications. We also have an additional subchannel Y. This is an anti-spoofing channel. Its idea was not to be turned on. It was supposed to be turned off and wait for its use. So again, there is an anti-kill switch that turns on the Y channel at

the right moment. But it turns out that this channel is already normally given, at least in Europe. In Europe, you can also catch this Y code on L1 and L2 channels. This is a code that has a digital signature, simply. digital signature, i.e. if we get some information, then knowing the public key, we are able to verify whether this information really comes from the source of the GPS satellite or from some other source. If the signature does not match, then we know that someone has been under the satellite, because only the satellite is able to sign this communication with the correct private key. What is the accuracy of this channel? Y is unknown. As the P channel gives a location even

below a meter today, so the anti-spoofing one, probably also in the documentation, if it leaked somewhere, it would be written. The truth is, and this is the general truth about all military systems around the world, that what is in the documentation is never true. Here, instead of 2 meters, it can be 20 centimeters. We are not able to verify this. There is also something that was included in 2009, along with the release of the new version of the M-code satellites. The M-code is also something that replaces the P-code. The P-code had a accuracy of 1-2 meters. The M-code is a new version after 20 years, after 30 years, basically. So you can think about it, if the 30-year-old had

a accuracy of 2 meters, what accuracy will the new one have? We don't know, but the latest American solutions, or NATO solutions, also use this code M. There is also something like an information disk. Information disk was a problem for all of us 10 years ago. 10 years ago, when you turned on the phone, turned on the GPS in the car, you had to wait 5-10 minutes before we got the fix, before our device found and will be able to read data from them. What was the point? For this system to work, our device, our cell phone, for example, when we run Google Maps, must have information on its board where GPS satellites are currently located and where they will be in a moment.

This information is nothing but an ephemeral. That's what it's called. It's a database with trajectories and the deviations of these trajectories in the nearest future. There's also ALMANACH, but it's fairly constant because it's a satellite system. Where are these satellites located? There are less than 30 satellites there. They're not new every day, so ALMANACH is fairly constant until a new satellite appears in orbit. And that's a few megabytes of data. This is a few megabytes of data. Ten years ago, this data was drawn from satellites. Our GPS system in the cell had to download these several megabytes of data from satellites. The speed of the satellite Internet is not devastating. And downloading this data took ten minutes most often. Today, this data is sent by

our cell phone operator. They go through a completely different channel, they go through 5G. or 4G or LTE. So today, when you don't do anything on the cell, the cell takes the data from somewhere. Every now and then, some task is running in the cron and it takes the data needed for GPS from the cell operator. In a moment, you will turn on Google Maps and you will want to see where you are. And it works. It works very well. This is an attempt to show on one drawing how all these different systems interfere with each other. What is GPS is yellow. So yellow blocks are GPS. As you can see, this GPS is not the only one. On the

frequencies that GPS transmits, it transmits at least Galileo. But thanks to the fact that the signal that comes from the satellite, the GPS signal that comes from the satellite is a modulated signal, CDMA, we don't have to worry about interference of two or three, or even in some cases we have five technologies. Because here on this strip you have five different technologies that give on one frequency. But thanks to coding, thanks to what the networks and modulation in the networks give us, it is not a problem for us. Could 5G be a problem for us? The question is theoretically stupid, because 5G has completely different frequencies, a completely different spectrum than GPS. But let's look at...

Here are frequencies that GPS satellites normally transmit, between this and this. It turns out that there is no such thing as a warning of frequencies in the global concept. You can't say that I have a system that gives a given frequency and no one else is allowed to operate on this frequency. I'm talking about the global context. In Poland, you can buy a frequency and no one else can use it legally. But globally, it's not like that. Interestingly, in the United States, there is no such thing as the URE office, the one that deals with frequencies in Poland. In the United States, there is such a possibility to take the frequency that someone else takes. Sounds a bit stupid, doesn't it? And if

our GPS works here, other cell technologies, the rest of which are marked as cell technologies, mainly 5G, works from the side, everything looks OK. GPS has shot itself into the gap between various subsystems related to 5G. You have to remember that 5G is a collection of various technologies. But there is one network provider - Ligado. A large company that provides Internet, but only in the USA. This company has established that they will use their 5G technology will be made at such frequencies, 1500 to 1700, exactly where the GPS is. Well, they decided that others don't do it there, so their competition will not disturb them in this place, so they decided that we take it. And the

US government says: "Okay, if you want, take it", forgetting that the GPS works there. And it ends with the fact that in military bases in the United States, soldiers are not allowed to use the Ligado cell operator, because if anyone had a cell in the operator's pocket, there would be interference between the GPS and this signal. And either the cell does not work, or the GPS in the vicinity does not work. Interestingly, the US did not learn anything from them and they can still operate in this way. It is only a matter of time until someone will interfere with these other radio technologies. Let's move on to the attacks. We have very little time. Spoofing. What is spoofing? Spoofing is nothing but sending

a false signal. Our signal will be stronger, so there is a chance that the receiver will take our signal as a legal signal, so we will be able to poison the GPS signal. What can it be used for? For example, to make Tesla drive into a tree from its neighbor. Why would Tesla need it? I don't have it, so my neighbor shouldn't have it either. These are attacks that used to happen. At the beginning, when these cars were pseudo-autonomous, you could fool such a car with a GPS spoofing. Today, fortunately, they are no longer so easy to give. But there is an application, Microsoft SoundScape, it is an application for the blind. It does not work in the

European Union for legal reasons, but it works in the USA. In the USA, a blind person can have headphones in their ears, can have a phone in his pocket and this application leads him. It says: "Go 10 steps straight, crosswalk. Stand. Turn right, take 10 steps, to the right you have a bakery." That's how it works. Well, it's on the phone. If someone spoofs the GPS signal and the phone trusts the spoofed signal, our colleague will go to the truck instead of going to the bakery. This is an attack that can really happen, especially if we show ourselves, I hope, at the demo part, spoofing such a cell is not difficult at all. That is,

deceiving it that it is in a different place than it should be. How is such spoofing done? First of all, you need to have these ephemeral. So you need to have information where satellites are currently located. This information can be downloaded for free from NASA. You have to register. The only thing you have to do is to check the checkbox that we need it for scientific research. And that's it. From the European Space Agency, you can download it completely without anything. So we download it. This is how it looks. There are even historical data. You can track how these satellites were flying since 1992. Then you need to have a tool that is able to generate a base with a false signal. You just need to go to

Microsoft's GitHub and download such a tool. GitHub is now Amazon, soon you will be able to buy mineral water there, so we download the tool. What else do we need? Something that will send a signal. So, a transmitter. And you can buy such a HGRF. It's not cheap, 1800 PLN, but you can buy it on Aliexpress for a quarter of this price. It's a fake, but it's made on better sub-units. The HGRF was designed 12 years ago and hasn't changed much, but the Chinese are changing it a bit and giving better things inside. You can also buy a Blade RF, but you have to add a few zeros to the price. But Blade RF also

allows 3G to be interrupted, so sometimes it comes back. And then we prepare the data. What do we need to do? We need to have the database taken from NASA. That's the first thing. We need to know where we want to move, i.e. what location we want to spoof. And that's basically it. We can also spoof this time, if we want to do the rolls on the stock exchange. And the rest are just control parameters. This presentation will be available, of course, for scientific purposes. To send it, you have to send it to this HGRF. There is such a HGRF Transfer tool, both for Linux and Windows, where we just send this file calculated in the first step. It will be sent to the

area. How can we do it in a moment? We'll see if your phones or watches can be used for it. What does it look like on video? This is an application in the background that shows what my GPS thinks in the laptop. Here I have the preparation of this data, that is, I say where I want to be, I say what the date should be, 15 April, and I prepare the data. This preparation of data takes about two minutes. After preparing the data, I can send it. So I start sending them and I look at how my GPS looks like in the laptop. This is a GPS bought for 1.70 PLN on Allegro. It was cheaper than AliExpress, so I bought it on Allegro.

As you can see, it detects that suddenly some satellites appeared. In a moment, if he can properly transform data from these satellites, he will start to trust some of these satellites. Then green satellites will be visible, illuminated. When he starts to trust this data, he has just trusted, he moved to Australia. To the center of Australia. It's simple. This signal is not signed in any way. This signal is not protected in any way. It is important that my signal mine as a spoofer was stronger than the one coming from space. And the signal coming from space is insanely weak. The satellites that are spinning there. Yes, it is so fast. It used to wait longer. Today

it takes 15 seconds more or less. There is no acceleration here. Okay. And in that case, There is also Garmin for 2000 PLN, which people use for running. It is very good for this attack. Real time is 10:23, and Garmin trusts the time given by such spoofing and changes its time to another. What is jamming? Jamming, like spoofing, was a signal to the left. We wanted to cheat someone, to spoof someone. Like a bank calling us and saying: "Hi, I'm from the bank. We were giving you 30 of our GPS, trust me". Jamming is something opposite. Jamming is giving some noise to confuse all the signals that are supposed to reach us. Jamming is widely used today in Ukraine or generally in

military operations, where we want to disturb the operation of the GPS on some territory. We don't want to say that there is some other location, we don't want to move the location, we don't want to steal anything. We just want to say "sorry, no signal" on the device. It is often used in conference rooms. Although jamming does not apply to GPS, but to 3G or other cell technologies, because we do not want people to have cell phones at meetings. There are several buildings in Poland that are covered with cell signal. In aviation, the pilot can be shown information like: "You are flying on the instruments from now on, you are not flying on the GPS

signal of the autopilot, but now you are either leaning on the star or you are flying on a sensor." Or you take other supporting systems, because aviation is such a industry in which they cope very well with various, one could say, catastrophic situations. This is one of the few industries where we have a book with answers to every question. And there is also an answer to the question: what to do if there is no GPS, how to land? This jamming can be divided into two types: low-energy and high-energy. Low-energy is up to 1 watt. And this is generally what you can do at home on things from Aliexpress. High-energy is 20 watts, but this is not the maximum. This is the maximum safe for

a person. If someone would give us more power in our area, there is a chance that it would be a little warm for us. But military systems do not care about human mass, so they can give even more than 20 watts. How could these 20 watts and this 1 watt at home at all threaten? So when it comes to silencing the signal, we can drive 10 kilometers with this 1 watt. If I would start it here, the Chopin airport would be hit by my silencer. Quite a lot of things you can buy on AliExpress. If I were to spoof the signal, i.e. give it a false location, it would be 350 km. These 350 km are not calculated, it is simply the horizon line. If I had

my spoofer on a balloon, it would be even further. This is the horizon line if the spoofer is on the ground. So it's really possible to make a mistake on the AliExpress toys. 350 km is half of Poland. One problem. How is it used in practice, for example, in Ukraine? It turns out that Ukrainians have weapons, air bombs, which are able to hit something based on GPS. And from the moment they had these bombs, their efficiency was at 70%. Probably not visible, but I will read it. 70%. So 70% was exactly the target. The Russians started using such speakers. And from the moment such speakers appeared, let's say they have 20 watts, how much they have, no one knows, the efficiency

dropped to 6%. So, this kind of muffler caused the accuracy to drop from 70 to 6. Quite easy, right? Now it is interesting that there are special rockets that detect the signal of the silencer and direct themselves to it. Because you have to destroy the silencer first. The silencer is very easy to destroy, just like a radar, because it gives a signal, so you can direct yourself to the source of the signal. When the silencer is destroyed, the next rockets are flying, which already have clean space when it comes to this navigation war. What if we started spoofing or jamming on the Warsaw Marathon? Half of these people run not to take nice pictures or run, but to have their route on the watch and then post

it on Facebook or something else. If we caused them that this data is worthless, they would stop seeing the meaning in life. They would stop running. Standard, right? Like going to the gym. Not everyone goes to lift something. We have to remember that the power of the signal is the strongest in the place where we give it. The further we are, the weaker the signal is. Every obstacle also weakens the signal. If we want to use low-power speakers, then you have to remember that they operate in a very limited area. This HGRF operates in a ray with an antenna without a amplifier, maybe 10-15 meters, that's the maximum. But you can buy a speaker up to 15 meters. It allows you to

mute many frequencies at once. It costs 500-600 PLN on Aliexpress. This is something that the directors of conference rooms buy so that people do not talk to them during their presentations. Of course, I remind you that this is illegal. There is also a stronger one. but also a bit more expensive. Let's say we can meet in the middle of the range, 45,000 dolts. But it already has a much, much, much larger range. It works only in one frequency. But if someone is familiar with electronics, they can play with it a bit and change these frequencies. This is one of the antennas of the complex in the Krulewieckie Oblast, in which the signal was broadcast almost over

the entire Baltic Sea. It is not this antenna, because it is an antenna for satellite communication, but somewhere in the area of this complex there are antennas, which were given by the jam signal just over the Baltic Sea and over northern Poland. This is a picture from a darknet forum for car thieves. If you want to steal a BMW and it is protected by a GPS locator, you can steal it cheaply. So you can make a jammer out of this guide for 200 dolts, with which we will sound the signal in a stolen car. Today it can go down to 50 dollars. Today this HGF can be bought even cheaper than it used to be. And this is an interesting answer from the Russians to drone attacks

on tanks, namely a mobile silencer on a tank. It is done in a home way, of course. We have a power supply unit, we have a lot of equipment, everything is nicely covered with ropes. It's a pity that there are no wires. The best thing is that it works. It works until it falls. If it falls, it stops working. But until it falls, in a radius of 100 meters, the signal, both the GPS signal, from which the drones use, and the video signal, from which the operators use, is relatively effectively muted. Somewhere on the Internet... Yes, it's the same here. The same, but it all depends on the price. These missiles that attack the signal sources are not cheap and it is more profitable to send them to

some radar stations or to some large speakers than to something like that, because if it was shot well from a flint, it would stop working and in a moment a drone that destroys the rest will fly. There is one more question, but it is more complicated, because we know that there is no black tape there. It has to sleep. And there is no tripod. My BMW is on the tripod, and there is no tripod here. So something without a tripod cannot work. That's my opinion. Okay, how does this jamming look like in practice? Now we will have a normal, real GPS signal. Of course, also transmitted by me. And in a moment, when this signal

is stable, it is already nice and stable, somewhere in Poland, I will turn on the jammer in a moment. You will see, the jammer will suddenly stop receiving the signal that you can trust. It may not receive the signal at all. You see, the signal suddenly stopped receiving the signal that matters to us. This is a second since the jammer is turned on. The jammer is, for example, this. This is nothing like a HGRF, only it is built so that you can carry it in your pocket or backpack. It costs less than a regular HGR, because it is Chinese, but because it is Chinese, it is so unstable that it disrupts everything. It sows around

so much that it disrupts everything that can be done. And turning on such a jammer causes the closest area, because it works again at a maximum of 50 meters, if it has a amplifier, and in fact at a radius of more than 5-10 meters, We can easily turn off the signal for someone. Don't play with something like that at city traffic stops, which rely on the time spent on these great signs, the bus arrival, from the information where this bus is located, because it takes it from the GPS. I will compare these locations. And we also have how to use the iPhone This is an iPhone that uses real signal. 14 Pro, 13 Mini and an old 5C. I'll turn on the jammer on the

left in a moment, which will disturb the signal. This one stops receiving the signal, this one doesn't know what's going on anymore. But this is a phone from years ago. 5C is years ago. This phone, i.e. 13 mini, is still somehow defending itself, it is still updating this information, but we'll see how it works in a moment. The 14 Pro seems to be completely insensitive to it. This one has lost the signal completely, it no longer knows where it is. It thinks it's gone to the mine. The last good signal was received 13 seconds ago, now it also stops receiving the signal. The 14 Pro is defending itself. And in fact, the 14 Pro defended itself. Why did the

14 Pro defend itself and the others did not defend themselves? Well, because there is something called marketing, right? Where is the current? Here. 14 Pro and 15 Pro have something called Dual Frequency. Dual Frequency is nothing more than using the L1 channel, i.e. the basic one, as well as the L5, the rescue channel. If we break the signal, we will only break one channel, because we have only one HGREF to break. So if we break L1, it will take the data from L5. Only if we had two devices, we would be able to break both L1 and L5. But it's not that stupid, because it has built-in, in addition to GPS, GLONASS, Galileo, ZQSS, Baidu and NAVIC. NAVIC is only in Japan now, but

But it works. So if we get it confused by GPS, it will take data from another system. So we would have to confuse a whole spectrum, huge spectrum, and in home conditions or with a home budget we are not able to do it. But the ordinary 15, there is no longer. The ordinary 15 uses one, it does not use dual frequency. It uses many operators, but it can't use Dual Frequency. So if you have a damn expensive iPhone 15, you have to pay two thousand to avoid jamming. And then if you have a damn expensive phone plus two thousand, you can feel quite safe that nobody around you will do anything to you. How to live? First of all, use multi-level things.

If we design a system, we design it for multi-system and multi-level. These chips are available, they do not differ in price at all. Let's just use the fact that we can take this signal from other sources. and compare with each other. For example, you can take a signal from 5G, because 5G also allows, thanks to the fact that we have a wave interference, it allows for location. 15 meters plus 15, but always. If we get a signal from GPS, we take it from 5G and we see that in GPS we are in Australia, and in 5G we are in Warsaw, then we know that someone is cheating on us and we stop trusting it. We can use Galileo and GPS. It's

not a problem. Today all these receivers can use several different sources. Do rockets do this? Rockets don't do this because on the battlefield, Russians, for example, attack many frequencies at once. They do so much jamming on such a large spectrum that the rockets are not able to cope with it. Here we are talking more about civilian things. At war, however, these things will not work anyway. But the rockets are able to cope in a different way. We have inertial guidance, i.e. the rocket knows how it flies and on this basis it can calculate more or less where it is currently, because it knows whether it has turned or not. And also something that is now very widespread, which will probably explode in half a year,

maybe a year, that is, navigation based on images. There is a camera in the rocket that observes the Earth below. It has a map of the Earth, the terrain, and is able to say where it is, in which place on the map. And that's happening now. Today, some drones fly based on images from the camera. Because the terrain is not easy to change. So if only the clouds do not interfere, and even if they do, we have subreddit technologies, we are able to determine the place where we are based on the terrain's drawings. And it will only be interesting to confuse it, whether it will be possible to confuse it at all. Because there is

no technology that confuses the subreddit. You would have to set the whole forest on fire, the whole field, so that it is invisible in the subreddit. It wouldn't be a stupid idea. The question is whether we use GPS in our business. But if we do, yes. Exactly. This is the general rule that says that the time in computer systems is underrated. In Active Directory, if the time is over, half of the domain is gone. If we had a source of time that is trusted for us, half of the problems will disappear, if not more. And we are talking about computer networks, systems and GPS. I agree 100%. I don't know if a rocket could have such

a time source. It probably could have, but it would be more expensive. Well, it doesn't. Procedures. This is what aviation has. Aviation has great procedures. If we have great procedures, we can also do something. Not to trust data. This is the basis. A person does not trust himself, but he has to trust the data that comes from space. So, another thing. And after all this time, I think that the blockchain is the best investment. I'm not a blockchain specialist, so it's hard for me to say, but blockchain gives you trust. So, yes, exactly. A scattered REES is something that cannot be poisoned by nature, at least in reasonable resources, or in reasonable resources. And also to check the resistance. This is an interesting thing, because in Norway, for example,

exercises are held every year in which the army poisons the GPS signal, the civilian market checks whether its tools, for example Garmin checks its watches, it does not work well, but it does, and the scientific community checks whether it is able to detect such a disturbance. Every year there is a Jamfest. There are reports from 2002 and 2003 to be downloaded. There will be a link to them in a moment. Why don't such things take place in Poland? It is true that it is on the WAC. of the Military Academy of Technology, a research team that deals with GPS interference. They have been doing this since 2009, but they do not particularly boast of their

progress. So it is not entirely known what they are doing. What they do, what they publish outside, are generally recommendations when it comes to agriculture and geodesy. Are they doing anything more? It is difficult to say. Here are some interesting links, including some things on YouTube where you can practice it yourself. We have minus 15 minutes of time, so the question is what to do with the 5-minute Dem. This clock is analogous here. This one is already poisoned. Okay, so we do this. If someone doesn't want their watch to change, because then they will have to go outside, they can go out now, their watch will not change. And if someone changes and wants to regain their real watch, you have to go outside and

wave to heaven for a while. Then the GPS signal will come and everything will be OK. I already have the packages prepared. I have a package prepared for calculating our location. I have already allowed myself to submit the location. It's hard to tell me what kind of location it is, looking at it, it's not our half-ball, so we'll move somewhere. But the data is collected from 11 o'clock today from this Nasa website. Now these things are being calculated, i.e. the database of the signal that I will be transmitting is being calculated. And here I have a HGRF connected with a weak antenna, so as not to damage anything in the area, which will transmit this signal. You can turn on your cell phones, for example, on Google Maps.

You can also watch your watches. When we transmit this signal, theoretically, some devices should start showing this new location. It may happen that after the upload you will have to turn off and on Google Maps, because they sometimes fix themselves on the location at the beginning, but we'll see. Generally, most iPhones and most Androids that we have recently checked, could easily be deceived. What apps did you use on the iPhone? These are two apps. As for the iPhone, I don't know where I gave it, but it's GPS Diagnostics for 18 PLN. And when it comes to Android, it's any app that shows GPS diagnostics. So everything that has GPS diagnostics in the name works on Android. And when it comes to iPhone, it's only this GPS

diagnostics that has such a name and costs 18.99, I guess. It's a promotion. It also depends on how the store is located. Okay, this should be over, calculate. and we will be able to send this signal in a moment. I also have a classic, small, GPS connected here, so I can turn it on to collect data here. Of course, it will not collect any data from real satellites, because this signal does not reach here. We are in a building, but when I start, at least it detects two satellites, one G4, the signal falls through the window somewhere, We'll see how it goes. Have you tested drones? I've tested what happens to scooters. Because scooters charge you for the distance traveled. Some

don't charge. But some also suddenly stop because they say something is wrong with them. But they don't charge you for the trip to Austria? No, no. I haven't had that happen yet. It's obviously a scientific study. No, no, I turned on the jamming, so I muted the signal so that the scooter could not set its position. The sides are falling apart spectacularly. Yeah, well, okay, we have to be quick because the battery is falling. Okay, let's go. And here the signal is transmitted. This one already sees some signal, he has not trusted anyone yet, but he sees that it is. I wonder how your cell phones or your watches are. I also have some Motorola here and we'll see what Motorola says.

Motorola started to trust many satellites, but it didn't catch any of them. Time should be changed, so if any of you have a Garmin, it should be time to change. This is the real time, 16:53. I'm talking about watches. Time should be changed to watches, if they are eligible. Apple Watch takes a watch from iPhone. So you can't use Apple Watch. This one trusted us and moved us to Australia. Generally, the same chipset is in most mobile phones. So they should trust us too. Sometimes you have to turn on and off Google Maps. It will be stupid if nobody succeeds, only me. But this phone succeeded. This phone is in Australia. You are also in Australia. At least one of you succeeded.

You didn't succeed. It happens. In Australia, on the other side of it. Maybe he trusted 5G more. It's an interesting story about EDRs, for example. EDRs catch something like logging from strange locations in Windows. If you logged from Poland yesterday and today you are logging from Australia, most EDRs give an incident that you couldn't overcome such a route. Yes, but it generates a lot of false positives. I haven't seen anyone who would trust it yet, because every VPN, for example, then cheats, because it's done on the basis of IP. Yes, yes. Well, here I caught one person, if I saw correctly, two. It's not spectacular that it's a shot right away, but... Has the clock changed the time for someone? No.

It's on the phone. It's an interesting phone. Ok, that's all from me. If someone wants to play with it, it's not impossible at all, because all this equipment can be bought on the European market. There is a shop called Lab 401 in France. If you buy something from them, they don't touch it anymore, so no one will stop you. So all the hacker toys, if they come from France, from Lab 401, there is no problem when it comes to Polish services at the border. As for using it, there are a few paragraphs at the beginning, but playing with HGRF on the desk shouldn't ruin anything in the area. Up to 10 mW, which is a very small signal,

there are no sanctions at all. So it's that interesting. You can play up to 10 mW, HGRF has about 60. Are there any more questions? This is called HGRF in the PAK port. H2. If you call LinkedIn, I will send you an auction where I bought it or a store where I bought it, because he is still selling it. I turned it off because my battery died, so it's dark. Thanks. What does it do? Does it not disturb the light to the top? The one you showed, the Russian one, that this antenna... No, no, it was not an antenna that disturbed the GPS. It was an antenna for communication with satellites. Somewhere in this complex there is another antenna that disturbs the

GPS, but it has no official photos. Who wants a microphone? Michał. I think most people will be smart. But no, no, no, it's just a smart approach. I have to ask questions or should I leave? Quick decision. No, stay, stay. You can send me a picture when I present it. Send it to your driver. Yes, I'll send it to the master of the bridge. Martyn asked me to share. Martyn is not your driver. She is the driver's driver. You'll get the cable, right? I have this cable. And will this work on Linux? Listen, I use operating systems, you use shit. Okay. You don't have any ransomware here? No. For sure? Only presentation. ... There is another one. But is it the same presentation?

No, no, no, it's for this. For what? For the clicker. Yes. Do we have a service clicker? No, it's private. - . It works, it works. It works, it works. It works, it works. - Okay, okay. - If something happens, FN F5 will switch you or escape, you exit, and FN F5 will turn you back on the presentation panel. - Okay, okay, thank you very much. - ... I don't know, I haven't talked to Paweł. He was there, you know, there was probably a question of showing things that are not entirely obvious and here it was probably about it, I think, because Paweł mentioned something just as I was in the kitchen with him recently,

I saw that there were some things that were not entirely visible. um I prefer not to connect my laptop to some networks, etc. But I have to change it. Besides, I don't really like traveling with it, with service equipment. But you have this Samsung, right? Yes, yes. I know, I know. I'll remember it and I'll wear it everywhere. Thanks, Krzysiek. I Super. Good. Send it to the witness. Yes, yes, send it. Good. I have some more. I - Okay. I don't know if I should wait or start. Okay, I don't know. Maybe when we start, we'll finish it quickly. During this presentation, it will be one of the few jokes, because the topic is difficult. So maybe those

who have already posted it did well. But I will say... I am Michał, I am from NASK, I am a specialist in NASK from the office of the NET. Generally, when you think about cybersecurity, you think about such a hard, systemic cybersecurity, whether public or private. However, cybersecurity is also illegal content. These are illegal content and the Nasko is responsible for the illegal content. Now, a bit provocative title. 202kk is not pornography. I'm warning you again, it's a very difficult topic. I will talk about the content of SISAM, i.e. content that presents sexual use of minors on the Internet. Article 202 of the KK refers to such content. I will briefly explain what it is. First,

I will explain the definition of this. what Polish law says, on the scale of events. I will tell you a bit about the duty net. Then I will talk about international cooperation, how to deal with it, and why the global system is so important in the fight against such threats. And at the end I will talk about the territories, if you have the strength. Okay. CISAM. "Child Sexual Abuse Material" - these are content about sexual abuse of minors. Why is it not pornography? In Polish law, there is a term "pornographic content involving minors". It is very important to use this position, because pornography is associated with such a entertainment industry, so it is very important not to talk about these topics

in such a way.

Okay, moving on. Article 202 of the Criminal Code is quite long and concerns generally broadly understood pornographic content, both presenting to people, third-person people, imposing their acceptance, What interests us most are paragraphs from 2 to 4b. They are about dissemination, sustainability, distribution, storage, The content of the pornographic or content presenting sexual abuse of minors, this article also refers to the so-called "hard pornography", i.e. zealots and violence. What does the duty net react to? Maybe I won't read this slide, there is a lot of text here. I will move on to the numbers. InHOPE, International Association of Internet Hotlines, is an international association, which I will tell you about in a moment, which plays a key role in the fight against these

content due to its global nature. These are statistics from the association for 2023. It is worth noting the number of confirmed incidents: 785,322. reports on the content containing sexual abuse of minors from all hotlines. 88% of these materials are new materials, not yet detected. 22% are those that are being and even though they are removed, they come back all the time. 69% of this number are indeed classified by Hotline as illegal in a given country where they are located. World statistics or European scale? No, it's... World statistics. This is world statistics from the INHOAP report. I will go to the place where they are located. There are also statistics on removing these terrorists, reporting them to the police,

both globally It's quite difficult. The green ones were removed or reported on the same day in a given country. Blue is 2 to 7 days and yellow is 7 days. And here, globally, it looks like 82% of the people are reported to the police on the same day. 74% of cases were reported to ISP on the same day. The problem is with the removal and only 23% were removed on the same day. This is a problem with ISP and hosting. with places where these materials are hosted. In Europe it looks like this. I won't read it anymore. Moving on, here is the age and sex of victims. Almost 83% are people in the category between 3 and 13 years old. These

are the remains of those people. I will tell you more about it in a moment. This is the Baseline category. It is about the fact that people up to 13 years of age, in the whole Inghop, in all hotlines, these materials are illegal. People above 13 years of age or Yes, more than 13 years of life, it can be different. But when it comes to pay, 95% are girls, 3% are boys. However, in 2022, boys were 7%, so it also decreased.

Where are these teresas located? Again, there is an agenda at the bottom. The green color is 15% higher. Yellow is 5-10%.

Blue is 3 to 5, and here there are simply fewer of these teres, but indeed the most of these teres are generally in the United States. Plus, there are also many of these teres in China, but China is generally outside of In Hope. China doesn't have its own hotline. It's also a matter of where InCope works, which countries it has contracts with and which it doesn't. In the next order, there is Russia. And going further, what it looks like in Europe. Here is the legend, this is how it looks in Europe, how these contents are distributed. Okay, moving on, I will go to our Polish statistics, the office of the Ministry of Internal Affairs. This is a chart that

which shows how the Teterers look like from the beginning. The Polish Hotline, a Polish team reacting to the Teterers, was established in 2005. This is how it looks like until this year. Blue color represents all the incidents that have happened to us. The red color is the number of reports of potentially illegal content, already concerning the content involving minors. The content I'm talking about. The black color, the smallest one, These are already verified content, which shows sexual abuse of minors. I will also talk about this in the trends. I will only point out that we have a huge outflow of content in Poland this year, which has never been before. But I will talk about it when we move

on to the trends.

Here are the general statistics. Maybe I'll do it the other way around. First I'll talk about the police station, and then I'll go back to the statistics. Dyżurnet was established in 2005 as part of NASK. It is the only expert team in Poland to respond to illegal materials on the Internet, which show sexual abuse of minors. The team's mission is to ensure the safety of the network. The office also operates under the KSC, the National Security System, under this law. It also operates under CSIRT-NASK. It is also part of the Polish Center for the Safe Internet Program. I will come back to this. materials presenting sexual use of minors, hard pornography, racist xenophobia and other illegal or

harmful content.

This is a more detailed statistic. SISs are the content that represents sexual use of a minor. SISs are the content that represents sexual use of a minor. that something has to be considered as a SISAM, it must be illegal in Poland. There are a lot of content that is not illegal in Poland, but it is evidently suspected. It is not sexual use, but it is or photos of films with sexual subtitles that portray a child. That is why there is a difference here. There is also a statistics of 35 reports promoting pedophilia activity and so-called grooming, i.e. leading a child.

Yes, here are also statistics of how it has been going over the years. Okay, maybe I'll go on. And now, the Law on the National Cybersecurity System is the establishment of the office of the Office of the National Security Service. Here is chapter 6, the tasks CESIRT-MON, CESIRT-NASK, CESIRT-GOV. to the tasks of the RTE-NASK session, such as providing the service of the telephone line or the Internet service, which conducts activities in the area of reporting and analyzing cases of distribution, dissemination or transmission of child pornography through information and communication technologies. As I said, in Poland, the term "child pornography" appears all the time and is being persecuted. What does the police station do in general? I have already said a little

about it. It is 202 KK.

also hard pornography, but it is also racism and xenophobia, 256 and 257kk. Other illegal content, not included in any of the above categories, but they are also dangerous for children. Here is article 200, 200b, 200a. Among others, there is grooming, praising the behaviour of the pedophile. And the phenomenon of sexual harassment is not only for children, but also for adults. Article 191. The Dispute Network works on the basis of reporting. You can report illegal content by form on www.dizjurnet.pl, by e-mail. with the help of Chrome and Firefox browsers and also with the help of an automatic infolink. However, I do not recommend doing this because it is only an automatic secretary, no one receives it there,

only later these recordings are listened to. Usually when people call this number, they are mistaken for a trust phone. This is not a trust phone, this is an info line to report incidents. International cooperation. How does it look? As I said, InHope plays a very important role here, which I will tell you about in a moment. InHope also cooperates with Interpol and this cooperation is very tight here. On our Polish soil, we mainly cooperate with the police, with CBZC. We operate as part of Safer Internet, as I said, and we also cooperate with the Foundation "We give strength to children" - the phone of trust for children and youth 116 111 led by this foundation. and

116 SOS for adults.

OK, moving on to what InHope is, why is it needed? As I said, although this year, as I will say in a moment, there is a lot of Polish content on Polish servers, there is not much of it in Poland. There are relatively few of them in the whole world. InHope is the union of hotlines from different countries around the world. Currently there are 54 hotlines, but some countries, such as Germany, have up to 3 hotlines, so there are about 50 countries. The aim of InHope is, above all, to exchange data between hotlines. In practice, it is about the fact that if we have an ad, for example, where we see that these files are in the Netherlands or in the

United States, through the InHope database, the so-called IC-CAM system, we are able to transfer this application to a given state and in this state it is already further applied to the racing and to the removal of the ISP. The second important issue is cooperation between INHOPE and Interpol and local racing bodies. The local hunting bodies mainly cooperate with individual hotlines. The global cooperation of InHope with Interpol is the most common. The third point is the United Voice of Hotlines. in dialogue with the law enforcement, with internet services, the possibility of transforming some law to protect the interests of the youngest people, etc. Another issue is certification and evaluation of individual hotlines. Inhoop has its own standards to which

hotlines must adapt both in terms of operational work itself, but also in terms of safety. And here I smiled because I was only partly expecting a lecture about wellness. In this profession, working in a hotline, taking care of your mental is very important here. It is a very difficult and demanding job, long-term. And training experts. Here, of course, there are more benefits that come from the fact that InHope exists. I decided that these are the most important ones. This is the map of the whole InHope, but it is from the InHope website. It is not up to date, it is from a year or two ago. The yellow color is the countries belonging to the Inhofe. The blue color

is the countries that are taken care of by the British and the WF. which is a British hotline that is very large and also takes the countries under its wing, which do not have their own hotlines, but somehow want to cooperate. And the color white is countries outside of INHOPE. It is also worth emphasizing that Ukraine Ukraine has been part of Inghoop since last year. Russia is in Inghoop. It is officially in Inghoop. It is officially responding to the terrorists. From what I see, I am officially reacting to the content. It is even monitored and most of the content on Russian servers is deleted, which is reported there. However, the question is, for example, as I will

say in the forums in a moment, about this release on Polish servers, for what reason is it? I have no idea. Maybe it is. It doesn't have to be. I will say that it is not that we have a concept of how much content is on Polish servers. We only know how much content has been reported to us. However, it can be a difference. And now the question is... I don't want to talk about Russia any more. I'm asking about Canada, because it's a big white flag. If you're in the States, you're fighting with them. Canada was in Inhoop. Inhoop was one of the founding countries. Something political happened. They have their own hotline, but it

is not in Inhoop. Yes, because they are not in the INHOPE system, you just have to report to them. However, in Canada, there is relatively little content, at least as a result of the reports. So it's not like you have to report it to them individually. Another difficult topic is the division Baseline National. Baseline is the material, the content, considered illegal in all of Winkhop's countries. It must be a picture of a real child in pre-birth period, up to 13 years old. It represents sexual contact or an anal or genital area. It is very narrow, it is quite narrow here. All the other ones depend on the countries. When you send it through InHope, the

content is marked. whether it is national or illegal in Poland. If it is only national, then in the country where it is, it does not have to be illegal. What is illegal in Poland is more boring.

This is the last block, so we will slowly get closer to the end. I will tell you about a few trends. First of all, what I said at the beginning, on Polish servers, in 2024 we recorded a lot of material. And here I will say that in June, in one cycle, such an announcement, information about the content of over 10,000 materials on the Polish server. It was also the case that they were on the Polish server for some time, then they emigrated to the US, then they emigrated to China. Now, as we have monitored, they are in China. So, indeed, sometimes the fight against these terrorists is very, very difficult, due to the possibility of migration, basically,

all over the world. Next, I will tell you about the so-called sexual self-generated content, about so-called cap-site sites Another trend that would be a separate debate, and I don't know if you would describe it better than me, is deepfakes. There is a certain visible and related trend with artificial intelligence, which generates various types of content. And we have a problem, because whether it is really a person hurt, whether it is already content generated by artificial intelligence, and there is no injured person. So there are also such challenges here. Sorry, you probably noticed, I speak quite chaotically. I just have this style, I hope it's understandable.

This is the record number of content in June on the Polish server. I've already talked about it. Next, what is sexual self-generated content? It is a phenomenon that has been gaining popularity for a few years. These are materials that represent sexual exploitation of minors, but which minors themselves upload to the Internet or send to other people. These are all kinds of nudists, softies, dickpics, I don't have time to talk about it here, because it is also a topic for a completely separate lecture. We wrote a comprehensive publication on this topic, available on the website of the Dispute. This is how statistics on this type of content are presented in Poland. These are statistics from the NASK

report "Nastolatki 3.0". The materials are self-generated sexual content, i.e. photo-video materials created by a minor person with a sexual character.

And here, this topic is connected with a number of different topics, different problems, social pressure, where this pressure is both in the relationship and such pressure, equal permission, as well as pressure from the Internet. Another problem is data leakage. During the research, researchers told us that the leakage of this type of photos is one of the most difficult things that can happen to a minor. Cyber violence, sexual harassment, But also, and this is surprising, the level of ignorance, and this came out both in the study that was carried out, Both in this study and in the level of ignorance in the reports by the reporters, because as I said, the report is also received by the police.

such as sexual harassment. And here I am explaining from adults also. And here, in general, the level of ignorance, trust, in general, entering Trusting a person who may potentially want to cheat us, want to get this kind of material and then blackmail us with it is enduring. Ignorance also applies to such portals as Snapchat, where during the research They said they have total trust in Snapchat, because after a minute or so, when it is set, it disappears. So when it disappears, it doesn't exist. Nobody is aware that it is still on the servers and that you can take pictures of it. Even with a separate phone, it is completely gone. And here comes the huge

need for support for people. As I said, it is a separate topic. Another trend here is the so-called cap sites, trade abuse pyramid sites. This has been around for two or three years. um When we imagine a financial pyramid, it works in the same way, but with these content. New people are invited, a code is generated and in order to get more content, they have to spread the code to more people and then they get more access. These types of links are available in various communicators, social networks. For example, Discord is a very popular environment for spreading these types of links. Where can you find this type of content? There is also a problem with them that they

are located in very numerous locations. Mainly it is Russia, but also the United States and Europe. Okay, here are some useful links. I will tell you about one initiative. Take it down is for minors and stop and see is for adults. If intimate materials leak, you can use it on this side. You have to submit this photo, but it is hashed, it is not saved in any way. And on the basis of this hash, it is checked in various databases, various portals. The database of these cooperating social media platforms is growing. If the photo is found to have been taken somewhere, it will be deleted automatically. This applies to intimate content, sexual content. It does not apply to

the image itself. This must also be remembered.

Okay, thank you for your attention. I have a question. How do you deal with it? I understand that you report to the server, but in my opinion it lasts for a week or two and longer. It is rare for Polish operators to block a given website. Unfortunately, so far there is no such possibility that the Polish operator would block this side. Perhaps it is somewhere there, we are also trying to make it possible, but for the moment, no. That's why international cooperation is so important, so that it is as efficient as possible, so that as many countries as possible participate in it. Because it's probably like that, as long as there are other topics, you can

have different approaches. So much so that this topic is the widest globally, where it is considered that something is wrong with it, that it should not be. So, yes, it is important from this perspective. Indeed, often these content is removed, and it is removed relatively quickly. Today it looks like this. When it comes to Polish services, they are quickly removed here. I don't have this statistics, but indeed, when we report to the Polish service, Polish services quickly remove it. It also hits the police. And that's how you have to fight it. You don't have to have contact with the police at every report. You write an email to Facebook, block the photo and that's it? Or you have to

have a receipt from the police? I mean, no. For example, Facebook is in the US. So we send this report to the US. We contact the police when the terrorists are located on a Polish server. But if they are on a foreign server, foreign agencies are involved in the chase. I have a question. It would be nice to report something like that if it is found, but I don't know where to find it. So I have a question: who reports it to you? Are these people who are hunting for such situations on the Internet? You know, like pedophile hunters, right? Are these some security guards who find something? We generally... Reports to us are anonymous. You can also send an email, but we assume we have

anonymous reports. It's hard to define who is reporting to us. But as I said, we report based on the report. We act based on the report. we are not able to monitor the entire Polish Internet today. Only what will be announced to us. And also on the side, we say about it everywhere, I understand that the pedophiles are doing more harm than good. It's a difficult topic and there are people who have a super mission that they will fight it. But no one should do it on their own. Especially since it can really destroy your mind. That's why we have a very large background here. We have a psychologist and a number of different strategies on how to take care

of yourself as part of a team of people who analyze this type of material. I have a silly question. You mentioned Facebook. Facebook is not in your jurisdiction, but in your jurisdiction, for example, Albiqlo. Is there a service that is in the social media, can it be used in any way? Is it also used for such things? Honestly, I don't associate it with Albiqlo's announcements. Regarding sexual use of human rights. You know, here too, I don't know if Albika was there, but on the side of the duty net, there was a study of Polish administrators. were made last year, cut out, where there were legal but socially controversial content. Partly such content was placed there, partly there was

found content, whether it was socially unacceptable or even illegal. If we found them, they were reported and the time of reaction was examined. And about Polish... I could even look it up here. It's a moment, I'm looking it up here. What was it called?

Here, as the side of the office, there is a knowledge zone. Here are the research, publications. Here are annual reports of the office, but also a lot of other types of publications. This was probably the report from the report to the reaction. That's what it's called.

Okay, any more questions? Thank you very much.

BSidesWarsaw track 2 dzień 1 cz 3

Related talks