Micah Hoffman, and Griffin Glynn - Play to Win: Teaching OSINT Through Hands-on Activities

good afternoon besides Augusta how's how y'all doing right now everybody got that Chick-fil-A kind of ah after lunch feel yeah that was my first Chick-fil-A Sandwich I've been in a different place in this world so I couldn't go but couldn't have they were pretty damn good pretty damn good and we're thrilled that you're gonna be here with us for the next hour or so um we do have some prizes to give away we have four prizes for those of you that ask great questions and participate with us also Griffin and I like doing things that are interactive so uh we need you if you want to play along get out your phone get out your laptop you're gonna need the Internet because the reality is that I could stand up in here and teach you about things on slides I could talk to you about how you need to learn by taking training or doing other stuff but that's not fun what if we did things a little differently that's what we're going to focus on in the next couple minutes Okay so we start out with a challenge this is an ocean talk we want to give you an ocean challenge what we're not going to give you is any help any hints any clues any knowledge or anything like that so you may already possess what it takes to solve this Challenge and that's great you may not so you might have to go and see if you can figure it out we're going to give you 60 seconds to do it in a second here three words are going to appear in that red box on the screen there's a structure that correlates with a location that are related to those three words okay those three words will take you to a place in the world if you know what to do and at that place in the world there's a structure we want the name of that structure in 60 Seconds and when you when you know that name of that structure yell it out the first two people to yell it out actually will get prizes now of course that means you don't actually have to do any of this you just have to be the first one to cat copy what the first person says and the second place person will absolutely be fine you ready yes let's do this here we go 60 seconds Starts Now where is this location uh yeah that might be good nice and we've got some lock picks for you young man here we go well done very very good 15 seconds that's great now for those of you that are wondering what the heck just happened um we're gonna reveal this to you but what we need you to do is think about uh I'll take this this is fun okay so think about your experience that just happened right there okay when we told you that this was the challenge you were gonna have to work with these three words I saw a whole bunch of people right away light up grab their phone grab their laptop they know what to do okay and then I saw a whole bunch of other people that are just looking at me like what three words what does that mean I don't understand so did you know what to do instinctively right off the bat did you have the knowledge already coming into the challenge in order to be able to be successful how did that make you feel if you didn't okay a lot of competitive people in this room I'm assuming right we all like to compete and win did that motivate you or demotivate you that you felt like either you were adequate or inadequate in your knowledge did you learn anything or were you even able to learn anything in the 15 seconds that it took someone else to solve it who had the knowledge maybe not oh it was true that was the Eiffel Tower and how do I know because we made the slides and I'll show you in just a moment all right very good so some of you had the knowledge and some of you did not but for those of you that did not could you have solved it if we gave you some hints so I'm going to show you a couple of hints here the first one would be the logo up on the screen those slashes inside that red box is a logo that you would have needed to know how to solve this challenge if you didn't already know some of you are probably thinking right now okay I can take that logo I can go work with it I know what to do here's another hint if the three slashes aren't familiar maybe a site like symbols.com can tell you what they mean so now another group of you all of a sudden leveled up and said you know what I think I could figure it out from here to find the correct location the correct geographic location you have to be precise with your spelling so those exact three words exactly how we spelled them would have led you to the Eiffel Tower in Paris France if you know that a site called what three words has mapped out the world in three meter squares and each one of those three meter squares has an individual con uh connection between three specific words in a certain order they don't repeat anywhere else and you can use those three words to Lead somebody to a three meter spot anywhere in the world congratulations you just completed a learning Capture the Flag experience and that's our talk everybody thank you very much for coming please thank you very good okay so and the point is some of you also gained some knowledge because not everybody in the room knew right off the bat that they were going to be able to solve that challenge but now every one of you knows how to do that or at least where to look so a little bit about us my name is Griffin online I go by Atlas wonder if you're involved in the online ocean Community um I I do a couple of different things I work with Micah in the myosin Training Site we gave a talk uh training rather two-day training this week on open source intelligence we also both are co-founders of the ocean Games capture the flag platform uh which we're going to tell you about here in a second I also am the director of intelligence for the national Child Protection task force and that's a us-based but International working non-profit heavily comprised of law enforcement prosecutors and now Tech professionals that combine their skills in order to work on cases of missing exploited and trafficked children around the world so we take the skills that we're going to talk about learning in this talk today and somebody like myself or the people on my team put them to work to help find Predators or victims of crimes against children and I have a history in cyber security I grew up doing b-sides up in the Washington DC area all around and I love cyber security and and the infosec community I've been around for a while I wrote a Sans class on open source intelligence I taught web app pen testing and I really found myself gravitating more towards open source intelligence or stalking people odds researching people online and when I was doing that I was like you know we can teach this we can help people learn how to do this because the techniques unlike many of the Cyber techniques where you might need an advanced degree in what the heck 802.16 is and how it propagates through metal versus wood innocent it's looking at social media it's looking at things that you and I do every day and so what I did was I created the myosync training company the ocean games company and uh Griffin has helped me out with some of those things but let's uh let's talk a little bit about what you're going to be able to get out of this talk first off we're going to be talking about what is Ocean's a little bit deeper because I know that this is info second I know that many of you probably already used osin in your work whether you're offensive defensive or somebody else that's not even in cyber you're doing open source intelligence you just don't know it yet also we're going to be talking about gamification how do you make learning fun who here has ever sat in a class and you're like I can't wait for this thing to to end what the heck is this guy talking about oh I could teach this yeah that's not fun that's not a way to learn that's a way to go to sleep and that's not what we're here to show you we're here to show you that learning can be fun all you need to do is find the places to do it also through the years of teaching either Sans classes or other classes Griffin and I figured out that people learn in different ways I know right it's weird but you know if you're a visual learner or a person that likes that do things with your hands like assemble Badges and what we're going to do is we're going to help point you at those types of online challenges that might be right for you all right and we'll show you where these challenges are okay so another challenge oh sorry that's mine that's yeah that's your cue we'll get this figured out we'll get this one okay so in the rest of the slides throughout this deck we've hidden three words okay they correlate to a monument now all of you should know what that means if you see a word that has red text and those three slashes in front of it they might not always be obvious but that's going to be one of the three words that are clues that will lead you to the Vic the location by the way that's not one of the words okay obviously we've experienced this before they are not in the correct order so you're going to get three words and you have to try some combinations figure out what the correct order is and when you get that go ahead and tweet it to us with that hashtag ocean games Augusta and the winner whoever tweets to us first we will reply to your Tweet and say great job so big big money on the line now the reality is is that you know we're talking about oh sent here at a cyber conference and uh set conference but like I said the world of Open Source intelligence or ocean is one that you've been in for probably decades and you didn't even know it many of you use the same skills to find things to research people to research products to look up who's doing what and what we do like Griffin said is we find people and we do that with a certain goal in mind hey this person is exploiting other people let's find where they live where they work what they do oh this attacker is hacking somebody let's research that domain that their their uh their information calls back to so there's lots of ways that we actually use um ocean skills in the world of cyber and really I mean as an offensive security person I used to do I used to love doing recon on my targets and and when I did I was amazed at what I found one of part of our process before we'd hack a website for a customer is we would Google the name of the website and when we Google the name of the website you never knew what came back but if you Google properly you could find some really cool stuff like one time I found this this help document who here reads help documents yeah oh look at you all reading the manual yeah yeah the funny manual um yeah so you read the help document and I'm reading the help document and my buddies are telling me hey Micah we need to be scanning this host we need to be exploiting I'm like whoa whoa whoa there Cowboy let's just read the manual so I read the manual sure enough on like page three it said if you want to log in to the application that we were testing enter a username like this and a password like that so I went and I entered that username entered that password and I was in my buddies were like what exploit did you use I'm like Google so there's a lot of power in these tools we are sharing so much data intentionally and unintentionally on the internet those of us that know how to actually find that are quite successful in our work now as I mentioned you probably have done some Googling or some mapping to get here right how do you find out where to park how do you find out where this location is pictures of Mark Baggett looking like a boss I mean these are things that people are looking for and they correlate to Ocean skills I was looking to see if anybody would take a picture of that no please don't please it is it is being tweeted to baguette probably yes okay so let's talk about gamification the science of gamification you probably experienced gamification all throughout your lives in different ways and we want to talk about gamification as it relates to learning there's a number of different reasons why it makes learning experiences better how many people in here as part of their job are tasked with training other people a lot of hands right so the traditional way of training people is you prepare your materials maybe you get some walkthroughs you put everything together in a logical order you uh lay it all out in slides and you go and you present the material okay and that's fine for some people and they can learn that way and they can see it and depending on your presentation they might be able to absorb that but other people just don't quite learn that way okay some other people might need a little bit more Hands-On or they might need a little bit more mental motivation maybe they need some type of reward or uh you know the motivation of achievement or things like that gamification brings that into your teaching so if you teach I would encourage you to think about how to gamify your learning we just taught all of you how to find what three words and use that to make a location that was fun right okay better than us showing a slide has what three words website on it and telling you what it is it was a challenge okay and everybody had that experience together and when you incorporate gamification into to your teaching style or if you know that it's part of a learning style that helps you learn and you look for resources that give that to you you're resilient to failure because failure in a gamified setting doesn't feel as finite as failure in your day job right it doesn't feel as as finite as I just got out of that training class and walked back over to my desk and I couldn't do the thing that I was just supposed to learn okay gamification helps you fail forward games can create an emotional connection I'm going to show you an image here and I want to know how many people have an emotional connection to this image a lot of people in the world right it's Candy Crush a lot of people have an emotional connection to that game they have to get in there they have to play it they have to have the daily achievements okay gamification hooks people in it makes it fun and entertaining something like this takes advantage of it and becomes a worldwide sensation okay think about the psychological aspects of gamification and how tangible it can make the learning for you but then think about your kids how many people in here have children okay how many of your children have a tablet or a device with games okay right and the kids love those things if they're like my kid my four-year-old would literally starve to death if I gave him a tablet that was plugged in and just walked away okay he wants to do nothing but play those games and he's learning I mean they learn colors they learn shapes they learn how to do things because that that learning is gamified it's fun okay who would have thought that learning could be fun also from many many years of being in the cyber world I know that there's lots of different types of ways to learn right we have captured the flags that I've played at Derby con if you remember Derby con at Defcon at other places and I have almost not showered for three days as I've been intensely focused on getting the most points in a certain game but I know that not everybody learns that way and that's really not motivated some people if you have a crisis situation or you have one hour or 60 seconds to do something people rise to the occasion especially if they're bringing their existing knowledge to Bear if you know about what three words and we say we're going to give you three words that represent the geographic location you are going to be able to better perform the tasks that we're going to give you and so what we find is that some of the educational experiences some of those capture the flags that are out there the people that are performing best are the ones that are already qualified to do those tasks the people that like to take their time like to make their notes like to go over their forms and processes those people are learning but are not necessarily going to be as successful on some kind of scoreboard also pressure I've seen situations uh so before cyber I was in medicine for a little bit and I've seen people just crumble under the pressure of a very stressful life and death situation have seen other people that just hop in and know exactly what to do also some of you probably do really well if you can just kind of relax you like your lavender candle you have your hacking glow lights on in the background right you set the mood now you're ready to go you got your Tic Tac yeah I mean these types of situations can be tailored these learning experiences can be tailored whether you love to compete show your name on a scoreboard get the high score get a perfect score get that recognition or whether you're a solo performer everybody should be able to learn the way that they want and imagine how how discouraging it would be if you are new to a field New to a topic and we're like hey look all these people have already gotten perfect scores and it only took them like two hours and you get to question one you're like I have no idea what even what three words is a little discouraging there would that make you want to continue learning maybe for some of you most of you maybe not also some people like working as a team some people need to play as a team and other people are more of those lone performers either way is absolutely fine and there are certain situations where one might be more beneficial to the other working as a team can be great because you can parse out things hey you cover this you cover this you cover this I'm going to focus on that and then we'll all come together and we'll win the challenge versus you being responsible for everything I know a lot of people that love being responsible for everything because they know that they can count on themselves they know that they're not going to take that two hour break after lunch because they're tired and the team will suffer so competition can be good also there are a lot of resources out there in cyber security there are a bazillion capture the flags that are free it people just giving it away there are also some that maybe have some type of donation associated with them or some other a monetary type of investment in the ocean World same thing we've got free ones out there we've got paid ones and and really you there's a there's a great mix you can choose which one works for you okay so we're going to talk about are there any ocean focused games okay some of you may be using oscent in your job right now in your daily lives some of you may be interested in Ocean maybe like Micah and they want to make the jump into just doing that full-time uh it's one of those things that just catches certain people it's fun right it's if you have the bug you have the bug and if you're one of those people like Micah and myself who really really love open source intelligence or you want to learn and you're fascinated we've got some resources for you I have a start me page that I'm a bit of an information hoarder okay I love knowledge I love to read people's blogs I love reading articles I like watching videos I like being in communities where I can learn from other people that's fun for me but it gets a little bit overwhelming okay so a long time ago I created a start me page and I used it to organize my own thoughts I have a section on my favorite blogs I have a section on my favorite open source intelligence tool sets there's like 50 different places in there just in the tool set section and each one of them might have two thousand three thousand different tools categorized based on what you're trying to do in ocent okay I don't have to think about where my resources are now I can go to one place and for those of you that are not familiar with what a start me is it's just a bookmark page of URLs these icons up here repres