← All Webinars | L.A.B.S. #10

Level: Intermediate🐥

Learn practical tools and strategies to counter these threats and don't miss the interactive Q&A. 

+ 

1
00:00:04.605 --> 00:00:05.285
Hello everyone.

2
00:00:05.635 --> 00:00:08.965
Welcome to, uh, the last installment

3
00:00:09.065 --> 00:00:12.885
of our five part series, uh, Summer Demo Days.

4
00:00:13.745 --> 00:00:16.565
Um, I am Kyle Miller, the Manager

5
00:00:16.585 --> 00:00:18.605
of Item Workshop here at ITS,

6
00:00:19.145 --> 00:00:22.925
and I am joined by Chris Glacken, our Director

7
00:00:23.025 --> 00:00:25.725
of Innovative Technologies here at ITS.

8
00:00:26.225 --> 00:00:28.725
Before we get started, uh, just a few housekeeping,

9
00:00:28.725 --> 00:00:30.685
housekeeping things we are recording.

10
00:00:31.145 --> 00:00:32.525
Um, you'll get a link

11
00:00:32.525 --> 00:00:35.125
to the recording in your email once we're done here.

12
00:00:35.745 --> 00:00:37.285
Uh, I have a Q

13
00:00:37.285 --> 00:00:40.485
and A tool open, so please feel free, uh, to use

14
00:00:40.485 --> 00:00:41.885
that if you have questions.

15
00:00:41.935 --> 00:00:44.005
We're going to try and answer those live.

16
00:00:44.545 --> 00:00:46.685
Uh, and if you see one that you like, uh,

17
00:00:46.705 --> 00:00:47.765
go ahead and up upload it.

18
00:00:47.875 --> 00:00:49.645
That'll bring it, uh, right to the top.

19
00:00:50.465 --> 00:00:53.925
Uh, and we will have a survey at the end.

20
00:00:54.305 --> 00:00:58.005
Uh, and we really would appreciate, um, ha if,

21
00:00:58.025 --> 00:00:59.445
if you could take a minute to fill that out.

22
00:00:59.465 --> 00:01:01.445
We, we do try and, uh,

23
00:01:01.515 --> 00:01:04.205
continually get better, uh, at these things.

24
00:01:04.265 --> 00:01:06.005
We wanna know, uh, what it is that,

25
00:01:06.035 --> 00:01:07.165
that you guys want to see.

26
00:01:07.665 --> 00:01:10.605
Uh, and of course, we're always, uh, willing to hear

27
00:01:10.945 --> 00:01:13.165
how great we did in our webinars also.

28
00:01:13.425 --> 00:01:18.125
So, um, in this session, uh, we're going to cover, uh,

29
00:01:19.365 --> 00:01:21.685
cheating, uh, in testing with AI.

30
00:01:22.265 --> 00:01:25.525
Um, we're gonna cover a few different ways that we know of

31
00:01:25.555 --> 00:01:29.005
that, that people are, are trying to cheat on online exams

32
00:01:29.005 --> 00:01:32.485
with AI, and then how to mitigate, uh, those threats.

33
00:01:34.125 --> 00:01:36.185
Uh, so what we're gonna do is we're gonna try

34
00:01:36.185 --> 00:01:40.745
and, uh, set this up, uh, similar to, uh, YouTube videos

35
00:01:40.815 --> 00:01:45.145
that I enjoy watching, uh, if, if, if you've ever seen any

36
00:01:45.145 --> 00:01:48.985
of those, uh, three levels of cooking on YouTube, where, uh,

37
00:01:48.985 --> 00:01:52.905
the first level is, um, an amateur, uh, cook, you know,

38
00:01:52.905 --> 00:01:55.025
making an omelet in, in three minutes.

39
00:01:55.125 --> 00:01:58.825
And the third level is, uh, you know, a professional chef

40
00:01:58.825 --> 00:02:00.865
that takes an hour and a half to make an omelet.

41
00:02:01.285 --> 00:02:04.185
Um, we're gonna do the, the same thing with, uh,

42
00:02:04.685 --> 00:02:06.705
the sophistication of cheating

43
00:02:06.815 --> 00:02:08.625
that we're seeing out there in the wild.

44
00:02:09.085 --> 00:02:12.305
Uh, so we're gonna go over, uh, three scenarios, uh,

45
00:02:12.305 --> 00:02:16.065
and then we'll also talk about how, uh, to mitigate, um,

46
00:02:16.675 --> 00:02:18.585
those individual types of cheating.

47
00:02:20.415 --> 00:02:24.955
Uh, before we get there, uh, Chris, I would like

48
00:02:24.955 --> 00:02:26.875
to ask you, uh, how did,

49
00:02:27.015 --> 00:02:29.715
how did you land on these individual scenarios

50
00:02:29.715 --> 00:02:31.275
that we're going to cover today?

51
00:02:33.195 --> 00:02:36.925
Yeah, so, so with regards to security

52
00:02:37.265 --> 00:02:39.925
and AI, so basically we landed on AI

53
00:02:39.925 --> 00:02:42.125
because that's kind of the theme of our, uh, summer series

54
00:02:42.125 --> 00:02:44.245
that we're trying to stick with, because the reason I'm

55
00:02:44.245 --> 00:02:47.645
saying that is because there is no limit on what kind

56
00:02:47.645 --> 00:02:49.245
of cheating vectors there are out there.

57
00:02:49.385 --> 00:02:51.045
It is just the possibilities are endless,

58
00:02:51.045 --> 00:02:54.805
and it's really important that if you are, um, responsible

59
00:02:54.805 --> 00:02:56.765
for the security of a test delivery program,

60
00:02:56.765 --> 00:02:58.165
that you're staying on top of those things

61
00:02:58.185 --> 00:03:00.390
and making sure that, that you're always staying on top

62
00:03:00.390 --> 00:03:02.605
of the latest and greatest, because there always is

63
00:03:02.605 --> 00:03:03.845
something newer out there.

64
00:03:04.545 --> 00:03:07.825
Um, with that being said, you can't, this, this is a topic

65
00:03:07.825 --> 00:03:10.585
that, that I enjoy discussing, but it, it's hard to discuss.

66
00:03:10.775 --> 00:03:14.545
Like, you don't, you don't want to talk about all the latest

67
00:03:14.565 --> 00:03:15.865
and greatest stuff out there, right?

68
00:03:15.965 --> 00:03:17.585
You don't, you, you want to educate people,

69
00:03:17.685 --> 00:03:19.345
but you only want to, you don't want

70
00:03:19.345 --> 00:03:20.745
to educate everybody, right?

71
00:03:20.745 --> 00:03:22.505
You don't wanna make other people's jobs easier.

72
00:03:22.505 --> 00:03:23.905
They're trying to come up with these things.

73
00:03:24.005 --> 00:03:26.385
So, so the way I landed on some of the topics

74
00:03:26.415 --> 00:03:28.785
that we're gonna discuss today is I just grabbed a couple

75
00:03:29.145 --> 00:03:31.745
publicly available, um, tools that, that are online.

76
00:03:31.745 --> 00:03:32.945
They've been online for a while,

77
00:03:33.365 --> 00:03:37.025
so this shouldn't be anything, um, really cutting edge

78
00:03:37.055 --> 00:03:39.625
with regards to security from that aspect.

79
00:03:39.685 --> 00:03:42.305
But it's something that I think is going to be new

80
00:03:42.445 --> 00:03:43.785
to a lot of people in this group.

81
00:03:44.285 --> 00:03:47.585
And I really want to just kind of use these to kind of

82
00:03:48.355 --> 00:03:49.845
provide awareness and,

83
00:03:49.985 --> 00:03:53.405
and insight into the type of things that, um, we're dealing

84
00:03:53.435 --> 00:03:54.885
with on a constant basis.

85
00:03:55.145 --> 00:03:59.365
So these are not going to be cutting edge attacks that, um,

86
00:03:59.565 --> 00:04:01.365
'cause you don't, you don't want to talk about those, right?

87
00:04:01.365 --> 00:04:03.045
These are gonna be publicly available things

88
00:04:03.045 --> 00:04:05.885
that will let your mind kind of get an idea

89
00:04:06.305 --> 00:04:08.005
of what's out there and the type of things

90
00:04:08.005 --> 00:04:09.165
that you're testing providers

91
00:04:09.165 --> 00:04:10.325
constantly trying to defend against.

92
00:04:12.225 --> 00:04:14.715
Alright, cool. Uh, let's get started.

93
00:04:15.015 --> 00:04:16.555
So why don't we start with, uh,

94
00:04:16.705 --> 00:04:19.195
what we'll call a level one cheater.

95
00:04:19.695 --> 00:04:23.875
Um, this, uh, this is gonna be some joker who needs

96
00:04:23.875 --> 00:04:26.195
to pass an exam, didn't study, uh,

97
00:04:26.415 --> 00:04:29.275
and just thinks, you know, they know how to beat, uh, know

98
00:04:29.275 --> 00:04:30.475
how to beat the system and,

99
00:04:30.495 --> 00:04:33.235
and cheat on an online, uh, exam.

100
00:04:33.455 --> 00:04:35.715
So, uh, what do we see kind of,

101
00:04:35.715 --> 00:04:39.275
are are the most simplistic ways that, that people will try

102
00:04:39.275 --> 00:04:40.395
to use AI to cheat?

103
00:04:41.525 --> 00:04:43.855
Sure. So, so one, like talk,

104
00:04:43.855 --> 00:04:48.015
talking about a base level on using ai, um, one that comes

105
00:04:48.015 --> 00:04:49.895
to mind that that's really interesting and it,

106
00:04:49.895 --> 00:04:50.975
and it's, it's good to kind

107
00:04:50.975 --> 00:04:53.695
of show in this is the ability to hide a window.

108
00:04:54.395 --> 00:04:56.855
All right? So if these are things

109
00:04:56.855 --> 00:04:58.335
that if you're using a more,

110
00:04:58.415 --> 00:05:01.735
a application based secure browser that's going to have, uh,

111
00:05:01.765 --> 00:05:04.495
much more access to the operating system than something like

112
00:05:04.495 --> 00:05:05.695
a web browser plugin or,

113
00:05:05.695 --> 00:05:07.695
or no security, all is gonna have, um,

114
00:05:07.995 --> 00:05:10.775
thi this is gonna be able to block these things much better.

115
00:05:10.955 --> 00:05:14.335
But so the concept of this attack is, I'm just going,

116
00:05:14.455 --> 00:05:15.575
I just, let's just say I want

117
00:05:15.575 --> 00:05:17.655
to use a basic Chat GPT interface.

118
00:05:18.015 --> 00:05:20.215
I have my test, and I just want to be able to go back

119
00:05:20.215 --> 00:05:22.215
and forth and answer my questions to the test,

120
00:05:22.555 --> 00:05:24.735
but my screen's being monitored by a proctor.

121
00:05:25.115 --> 00:05:28.095
All right? So now you can take this attack

122
00:05:28.155 --> 00:05:29.495
to a million different levels.

123
00:05:29.755 --> 00:05:31.815
All right? But let's just start with kind of the basis of,

124
00:05:31.875 --> 00:05:33.655
of how this type of attack could work.

125
00:05:34.195 --> 00:05:36.255
So, um, I'm gonna share my screen here

126
00:05:36.255 --> 00:05:38.415
because we want to kind of demo this stuff too,

127
00:05:38.515 --> 00:05:39.735
in addition to showing it.

128
00:05:39.955 --> 00:05:42.295
So let me get this going here.

129
00:05:45.225 --> 00:05:46.225
Alright,

130
00:05:47.055 --> 00:05:49.435
So the idea here, Chris, is I want

131
00:05:49.635 --> 00:05:51.115
to hide a window on my screen

132
00:05:51.115 --> 00:05:55.235
because I can have some portal like Chat, GPT, where,

133
00:05:56.565 --> 00:06:00.165
where I can, uh, just look up answers, right?

134
00:06:00.225 --> 00:06:03.325
So I'll have, uh, the window open that I need to have open,

135
00:06:03.325 --> 00:06:04.725
which is my testing interface,

136
00:06:04.985 --> 00:06:06.445
and I'll have another window open.

137
00:06:06.625 --> 00:06:08.205
You're gonna show us how to hide that.

138
00:06:08.425 --> 00:06:10.445
And this window could be something like Chat GPT,

139
00:06:10.445 --> 00:06:13.205
where I can just copy and paste answers, or copy

140
00:06:13.205 --> 00:06:15.285
and paste questions into and get an answer back.

141
00:06:15.875 --> 00:06:18.165
Exactly. That's the idea here. All right?

142
00:06:18.505 --> 00:06:19.845
Um, so let's see.

143
00:06:19.925 --> 00:06:22.525
I know Chat, GPT has apparently been going in

144
00:06:22.525 --> 00:06:25.605
and out all day, so it looks like for me, it might actually

145
00:06:26.305 --> 00:06:28.405
be going out again. So

146
00:06:28.435 --> 00:06:30.445
Yeah, they, they heard we were doing a live demo,

147
00:06:30.625 --> 00:06:32.485
so this is how demos go.

148
00:06:32.865 --> 00:06:34.005
All right. Okay, cool.

149
00:06:34.005 --> 00:06:38.985
Well, fortunately, um, we have our own in-house chat,

150
00:06:39.105 --> 00:06:41.025
CPT, so I'm just gonna pull that up

151
00:06:41.025 --> 00:06:43.025
because I want to make sure that we are kind

152
00:06:43.025 --> 00:06:45.865
of driving the point home as to, uh, what is possible here.

153
00:06:46.485 --> 00:06:49.625
All right, so here I have a basic, um, app chat application.

154
00:06:49.925 --> 00:06:51.905
Um, so this is something that Kyle, you

155
00:06:51.905 --> 00:06:53.865
and I have been working on constantly with the help

156
00:06:53.865 --> 00:06:55.905
of our friend Kris, um, on FEA team.

157
00:06:56.445 --> 00:06:58.785
So the idea here is it's just like Chat GPT, right?

158
00:06:58.805 --> 00:07:00.585
So I can go ahead and ask it a question

159
00:07:00.885 --> 00:07:02.265
and it's gonna respond back to me.

160
00:07:02.285 --> 00:07:03.985
So it's just like Chat GPT.

161
00:07:04.005 --> 00:07:07.465
But since Chat GPT is currently down, it's not going to, uh,

162
00:07:07.515 --> 00:07:08.785
we're just going to use this instead.

163
00:07:08.785 --> 00:07:10.505
So this is working through their APIs,

164
00:07:10.505 --> 00:07:12.185
which probably don't appear to be down.

165
00:07:12.855 --> 00:07:15.945
Okay? So let's just say that I have a test going,

166
00:07:16.445 --> 00:07:18.065
and I have my first question here.

167
00:07:18.245 --> 00:07:19.945
All right? But my screen is currently being

168
00:07:19.945 --> 00:07:21.225
monitored by the proctor.

169
00:07:21.445 --> 00:07:23.545
All right? So I'm gonna do the standard question here.

170
00:07:23.645 --> 00:07:25.665
Is my, is my screen currently visible?

171
00:07:26.245 --> 00:07:28.145
I'm assuming you can see my screen, right? Yes,

172
00:07:28.345 --> 00:07:29.345
I can see your screen. All

173
00:07:29.345 --> 00:07:30.225
right. Okay. All right.

174
00:07:30.245 --> 00:07:33.105
So my monitor's a little lower resolution, okay?

175
00:07:33.105 --> 00:07:36.505
Alright, so now if you were my proctor looking at my screen,

176
00:07:36.845 --> 00:07:40.225
you would be seeing that I have some kind of non, some kind

177
00:07:40.225 --> 00:07:44.875
of test based application here that is going to take my test

178
00:07:44.895 --> 00:07:46.715
for me, and I have my test, right?

179
00:07:47.645 --> 00:07:48.905
So that's not good, right?

180
00:07:48.925 --> 00:07:50.465
You, I don't want you to see that.

181
00:07:50.505 --> 00:07:51.865
I don't want you to know that I'm using that.

182
00:07:52.045 --> 00:07:54.945
So what I'm gonna do is I'm gonna use an application called

183
00:07:55.115 --> 00:07:56.225
Invis Wind again.

184
00:07:56.245 --> 00:07:57.665
So, like, like I said at the beginning,

185
00:07:57.875 --> 00:08:01.345
we're using publicly available applications, um, to kind

186
00:08:01.345 --> 00:08:02.425
of demo these concepts.

187
00:08:02.525 --> 00:08:03.945
All right? Um, so these are things

188
00:08:03.945 --> 00:08:04.985
that are out in the wild today

189
00:08:04.985 --> 00:08:06.665
that anybody can just go and download.

190
00:08:06.885 --> 00:08:08.665
All right, so this one is called Invisible Wind.

191
00:08:08.695 --> 00:08:11.105
It's short for invisible window. Alright?

192
00:08:11.445 --> 00:08:14.385
So like you mentioned earlier, the idea of this attack is

193
00:08:14.385 --> 00:08:16.025
that you can use this application

194
00:08:16.285 --> 00:08:18.105
to hide your window, alright?

195
00:08:18.255 --> 00:08:20.945
From any screen recorders, but not hide it from yourself

196
00:08:20.945 --> 00:08:22.305
because you still wanna be able to use it

197
00:08:22.305 --> 00:08:23.305
to cheat on the exam.

198
00:08:23.845 --> 00:08:25.665
And it's really simple application.

199
00:08:25.725 --> 00:08:27.345
You can see they have a demo right here,

200
00:08:27.685 --> 00:08:29.065
and they explain how it works.

201
00:08:29.645 --> 00:08:31.745
All right? So what I did is I went ahead

202
00:08:31.745 --> 00:08:32.825
and downloaded again.

203
00:08:33.125 --> 00:08:35.105
So one of the big themes, um, I,

204
00:08:35.105 --> 00:08:37.265
I've said this in some other, uh, presentations,

205
00:08:37.325 --> 00:08:39.825
but one of the big things that I really wanna harp on about

206
00:08:39.825 --> 00:08:42.225
these kind of, uh, any type of cheating is

207
00:08:42.225 --> 00:08:45.465
that it shouldn't, there, we shouldn't have a mindset

208
00:08:45.575 --> 00:08:48.105
that if somebody's smart enough to make an attack like this,

209
00:08:48.375 --> 00:08:49.465
then they're probably smart

210
00:08:49.465 --> 00:08:50.705
enough to pass their test, right?

211
00:08:50.705 --> 00:08:52.785
That, that is not a good way to think

212
00:08:52.785 --> 00:08:55.885
because I'm showing the exact reason it's not good right?

213
00:08:55.885 --> 00:08:59.485
Here you had somebody knowledgeable in this area, alright?

214
00:08:59.905 --> 00:09:02.605
And they made an easy to use application

215
00:09:02.605 --> 00:09:03.845
that anybody can go.

216
00:09:03.945 --> 00:09:05.965
In this case it's even free. All right?

217
00:09:06.345 --> 00:09:09.415
So, so that's important to keep in mind

218
00:09:09.415 --> 00:09:12.495
because I don't have to be very intuitive within

219
00:09:12.715 --> 00:09:14.815
how operating systems work or anything like that.

220
00:09:15.055 --> 00:09:17.575
I have to just know, oh, I don't, I had to just Google,

221
00:09:17.815 --> 00:09:20.055
I don't want my window to show during my test.

222
00:09:20.555 --> 00:09:22.775
How can I do that? And here's a publicly available

223
00:09:22.885 --> 00:09:24.215
application for me to use

224
00:09:24.215 --> 00:09:25.975
that's gonna go ahead and hide my window.

225
00:09:26.595 --> 00:09:27.735
So let's kind of take a look at

226
00:09:27.735 --> 00:09:28.815
how this thing works right here.

227
00:09:28.955 --> 00:09:31.015
All right. So typically you would set this up

228
00:09:31.015 --> 00:09:33.495
before you even get into your test, okay?

229
00:09:33.755 --> 00:09:35.375
So the app is called Invis Wind,

230
00:09:35.375 --> 00:09:37.895
and what it does is it just opens up a command prompt,

231
00:09:38.395 --> 00:09:40.335
and it's, it's very easy to use,

232
00:09:40.365 --> 00:09:42.055
even if you don't even know how to use it.

233
00:09:42.075 --> 00:09:45.015
It tells you go ahead and type help to get started, right?

234
00:09:45.035 --> 00:09:47.015
And just gives you the basic command you're gonna hide,

235
00:09:47.015 --> 00:09:49.455
and you can do it on process ID or process name,

236
00:09:49.715 --> 00:09:51.455
and then it will hide the application.

237
00:09:51.795 --> 00:09:53.375
All right? So let's go ahead

238
00:09:53.375 --> 00:09:55.095
and just get our process id, all right?

239
00:09:55.115 --> 00:09:56.575
We can do it by process name too,

240
00:09:56.595 --> 00:09:58.175
but let's just go ahead and look at it.

241
00:09:58.395 --> 00:10:00.895
So I'm using Microsoft Edge, so I want

242
00:10:00.895 --> 00:10:02.375
to hide my Microsoft Edge window,

243
00:10:02.515 --> 00:10:04.415
and I want to hide my application right here.

244
00:10:04.435 --> 00:10:06.615
So let's just, we're just gonna go and get that process ID,

245
00:10:07.435 --> 00:10:11.655
and so we can see that my process ID right here

246
00:10:12.395 --> 00:10:14.735
is 5 8, 8 8, okay?

247
00:10:15.275 --> 00:10:18.575
So what I do with my application here is I just go

248
00:10:18.575 --> 00:10:20.895
to 5, 5, 8, 8, 8,

249
00:10:22.015 --> 00:10:23.775
I enter it and it should be hidden.

250
00:10:23.995 --> 00:10:26.055
All right? Are you, it's gone. Able to see my, it's gone.

251
00:10:26.195 --> 00:10:27.935
All right. So let me just kind

252
00:10:27.935 --> 00:10:29.415
of drive the point home right now.

253
00:10:29.475 --> 00:10:31.095
So now I'm gonna close my application.

254
00:10:31.175 --> 00:10:34.055
I, no, no, I no longer even need that thing running. Okay.

255
00:10:34.635 --> 00:10:38.055
So now as far as you're concerned, you should just kind

256
00:10:38.055 --> 00:10:40.415
of see my test window right here, right?

257
00:10:40.915 --> 00:10:42.895
Yep. Okay. All right.

258
00:10:42.895 --> 00:10:44.135
So let's go ahead and make that full screen.

259
00:10:44.195 --> 00:10:46.295
So, if I was a student, I'm all getting into my test,

260
00:10:46.375 --> 00:10:49.815
I have my full test window, but now I get to this question

261
00:10:49.875 --> 00:10:51.735
and I need to answer my question, all right?

262
00:10:51.835 --> 00:10:54.335
So which of the following has the most syllables?

263
00:10:54.525 --> 00:10:58.635
Okay, so I could, uh, I could just type it in here.

264
00:10:58.635 --> 00:11:02.845
Which of the following has the most syllables,

265
00:11:04.775 --> 00:11:06.955
um, spaghetti.

266
00:11:08.485 --> 00:11:10.785
And this is visible on your screen to you right now,

267
00:11:10.785 --> 00:11:12.065
even though I can't see it,

268
00:11:12.135 --> 00:11:14.745
it's only hiding it from screen sharing applications.

269
00:11:15.005 --> 00:11:18.905
You're actually looking at our Chat GPT app right now

270
00:11:18.905 --> 00:11:20.265
and typing this question into it.

271
00:11:20.655 --> 00:11:21.865
That is exactly right.

272
00:11:22.125 --> 00:11:24.945
So let me just get my camera here to drive the point home.

273
00:11:25.685 --> 00:11:29.665
All right, so if you can see my, my screen right now, yep.

274
00:11:29.965 --> 00:11:31.625
It probably looks completely different than

275
00:11:31.625 --> 00:11:33.705
what you're seeing in the screen sharing software, right?

276
00:11:33.925 --> 00:11:35.945
So I asked it the question and I got my answer.

277
00:11:35.945 --> 00:11:37.865
It's thermometer right there. All right?

278
00:11:38.405 --> 00:11:39.945
So right there, but as far

279
00:11:39.945 --> 00:11:41.985
as you're seeing on the webinar demo, you're just seeing

280
00:11:41.985 --> 00:11:43.185
that my test is right here,

281
00:11:44.565 --> 00:11:46.305
so I can go back and forth to my test.

282
00:11:46.445 --> 00:11:48.625
And if you're just, if your only security is

283
00:11:48.625 --> 00:11:51.185
that you're monitoring it, doing a screen recording,

284
00:11:51.725 --> 00:11:54.165
you have no idea that I'm using this, okay?

285
00:11:55.025 --> 00:11:57.245
All right. So that, that's, that's essentially

286
00:11:57.305 --> 00:11:58.645
how the attack works right now.

287
00:11:58.645 --> 00:12:00.205
That's really basic. You're gonna have

288
00:12:00.205 --> 00:12:02.365
to be running pretty much no security in, in order

289
00:12:02.365 --> 00:12:03.645
to get away with something like that.

290
00:12:03.905 --> 00:12:05.765
But you can take this kind of stuff

291
00:12:05.765 --> 00:12:06.845
and there's other applications.

292
00:12:06.905 --> 00:12:08.325
I'm like, again, I'm doing this to kind

293
00:12:08.325 --> 00:12:09.365
of illustrate the point of

294
00:12:09.365 --> 00:12:10.965
how you can do these things, okay?

295
00:12:11.385 --> 00:12:14.365
So you can take this to other steps and put it on hotkeys

296
00:12:14.365 --> 00:12:16.205
and those type of things and all that stuff.

297
00:12:16.345 --> 00:12:19.125
Um, another thing is, uh, so, so what are some,

298
00:12:19.185 --> 00:12:21.045
so let's just start with how it works, all right?

299
00:12:21.045 --> 00:12:22.845
What exactly is making this thing work?

300
00:12:23.265 --> 00:12:25.965
So the way it works, and they tell you right on the website,

301
00:12:26.065 --> 00:12:28.765
uh, what they're doing there, not that you really, um, need

302
00:12:28.765 --> 00:12:31.805
to know that, but the way it works here is

303
00:12:31.805 --> 00:12:34.205
that they're just doing what's called a remote injection.

304
00:12:35.065 --> 00:12:38.085
Um, and they're injecting A-D-L-L-A dynamic link library

305
00:12:38.195 --> 00:12:40.485
that contains a piece of code into

306
00:12:41.045 --> 00:12:42.645
whatever target application there is.

307
00:12:42.715 --> 00:12:43.805
Okay? So let's just kind

308
00:12:43.805 --> 00:12:45.005
of break down what that means right there.

309
00:12:45.065 --> 00:12:46.685
So what that means is that

310
00:12:47.265 --> 00:12:49.405
I'm gonna make a little file, alright?

311
00:12:49.405 --> 00:12:51.365
It's called a DLL. I'm gonna make a little file,

312
00:12:51.665 --> 00:12:54.365
and in this file I'm going to call a command

313
00:12:54.365 --> 00:12:55.805
that tells the operating system

314
00:12:56.065 --> 00:12:58.925
to hide this window from any screen record sharing

315
00:12:58.925 --> 00:12:59.965
application on there.

316
00:12:59.965 --> 00:13:01.765
Alright? So I have this little file

317
00:13:02.025 --> 00:13:03.245
and I have a piece of code in there

318
00:13:03.245 --> 00:13:04.365
that says, hide this window.

319
00:13:04.875 --> 00:13:08.405
Okay? So now what I need to do is I need to get

320
00:13:08.405 --> 00:13:12.365
that little piece of code injected into my Microsoft Edge

321
00:13:12.365 --> 00:13:13.405
browser, all right?

322
00:13:13.585 --> 00:13:15.765
And when I inject it into Microsoft Edge browser,

323
00:13:16.275 --> 00:13:18.085
that code is then just gonna be run.

324
00:13:18.115 --> 00:13:20.285
Okay? I'm, I'm greatly simplifying this, okay?

325
00:13:20.545 --> 00:13:22.245
So in order to do that, that's called, um,

326
00:13:22.245 --> 00:13:24.325
what you're gonna do is you're gonna create a remote thread

327
00:13:24.625 --> 00:13:25.885
in the Microsoft Edge,

328
00:13:25.945 --> 00:13:28.005
but really just think about it at a really high level,

329
00:13:28.385 --> 00:13:30.125
is you're just taking that piece of code

330
00:13:30.425 --> 00:13:33.005
and you're throwing it into Microsoft Edge,

331
00:13:33.835 --> 00:13:35.415
and then it's gonna run that piece of code,

332
00:13:35.435 --> 00:13:37.335
and now it's hidden and you're good to go.

333
00:13:37.335 --> 00:13:40.055
You're off and running. That's how the attack works. Okay?

334
00:13:40.475 --> 00:13:44.935
So, um, so, so how can you block something like that, right?

335
00:13:44.935 --> 00:13:47.055
Because the screen recorder's not gonna catch it, right?

336
00:13:47.355 --> 00:13:49.975
So what's gonna help you out there are looking

337
00:13:50.035 --> 00:13:51.975
for other things, other patterns, right?

338
00:13:52.195 --> 00:13:54.055
You want to check to see is like if,

339
00:13:54.075 --> 00:13:57.735
if you don't support hosting multiple applications on your

340
00:13:57.735 --> 00:13:59.455
system, you want to make sure you, you can monitor

341
00:13:59.555 --> 00:14:02.335
for things like, well, is my test window losing focus?

342
00:14:02.465 --> 00:14:04.695
Right? Those are some things you could check against.

343
00:14:04.875 --> 00:14:08.175
Um, another thing, uh, you might think is, uh, well,

344
00:14:08.675 --> 00:14:10.575
is there, is there a Microsoft process

345
00:14:10.575 --> 00:14:11.655
running on the computer?

346
00:14:11.795 --> 00:14:14.415
Can I just suspend every anything with Microsoft Edge?

347
00:14:14.955 --> 00:14:16.815
So, um, you, you could do that,

348
00:14:16.835 --> 00:14:18.295
but then that, that gets into some

349
00:14:18.295 --> 00:14:19.895
other interesting attacks there.

350
00:14:20.075 --> 00:14:22.575
All right? 'cause something that you could do there is,

351
00:14:22.585 --> 00:14:24.735
let's just say, I just wanna hide my

352
00:14:25.055 --> 00:14:26.135
Microsoft Edge completely.

353
00:14:26.685 --> 00:14:30.235
Okay? Alright. So let's see.

354
00:14:30.455 --> 00:14:31.675
I'm gonna share my screen again.

355
00:14:31.695 --> 00:14:33.595
Am I still sharing? I need share everything. Uh,

356
00:14:33.615 --> 00:14:34.755
No, I, I, uh, I

357
00:14:34.755 --> 00:14:36.075
minimized it. Go ahead and share it again. All.

358
00:14:36.185 --> 00:14:38.835
Okay. All right, so let's go ahead and do this again.

359
00:14:38.895 --> 00:14:40.515
So I'm gonna share my screen here,

360
00:14:42.005 --> 00:14:44.385
and then I'm just going to go ahead

361
00:14:44.685 --> 00:14:48.185
and just run something very simple on my end that's going

362
00:14:48.185 --> 00:14:50.065
to make it, so I am actually hiding

363
00:14:51.125 --> 00:14:53.965
Microsoft Edge from my entire operating system.

364
00:14:54.235 --> 00:14:57.125
Okay? So we'll go ahead and open up task manager here.

365
00:14:57.125 --> 00:14:59.045
We see Microsoft Edge isn't currently running,

366
00:14:59.065 --> 00:15:00.085
but I don't have it running.

367
00:15:00.315 --> 00:15:02.085
Okay? And so we can go in here,

368
00:15:02.135 --> 00:15:05.125
let's see if there's any processes that are still okay.

369
00:15:05.125 --> 00:15:07.125
So we'll just get rid of all my Microsoft Edge.

370
00:15:07.145 --> 00:15:10.365
All right, Ms. Edge XC is not running. Okay?

371
00:15:10.905 --> 00:15:14.085
So now what I'm gonna do here is I'm gonna go ahead

372
00:15:14.665 --> 00:15:16.245
and start up Microsoft Edge.

373
00:15:16.755 --> 00:15:19.285
Okay? Microsoft Edge is now started up,

374
00:15:19.625 --> 00:15:20.645
but it's not showing,

375
00:15:20.785 --> 00:15:23.965
my computer isn't even representing the Microsoft Edge is

376
00:15:23.965 --> 00:15:24.965
running right now, right?

377
00:15:25.305 --> 00:15:27.125
So that's just the kind of illustrate.

378
00:15:27.125 --> 00:15:29.085
So this is a, this is taking the attack

379
00:15:29.085 --> 00:15:31.165
to a much more higher level that we don't really have time

380
00:15:31.165 --> 00:15:33.845
to get into today, but I really wanted to kind of show this

381
00:15:33.865 --> 00:15:36.845
and be like, okay, you can do different things

382
00:15:37.105 --> 00:15:38.485
to elevate certain attacks.

383
00:15:38.495 --> 00:15:40.205
There is no just one way to do things.

384
00:15:40.415 --> 00:15:42.725
These are all just kind of, you can combine

385
00:15:42.725 --> 00:15:44.765
and get to the pieces and figure this stuff out.

386
00:15:44.785 --> 00:15:46.125
So that's really why it's important

387
00:15:46.125 --> 00:15:47.885
that you have these secure browsers

388
00:15:48.105 --> 00:15:49.965
to protect your content if that's something

389
00:15:49.965 --> 00:15:51.565
that you care about for your test delivery.

390
00:15:52.985 --> 00:15:55.125
So, but just to drive this point home though,

391
00:15:55.155 --> 00:15:57.765
this is all stuff that someone without development

392
00:15:57.765 --> 00:16:00.805
experience, without even a lot of cheating experience,

393
00:16:00.835 --> 00:16:03.245
they can just download and execute this stuff, right?

394
00:16:03.275 --> 00:16:06.725
Like our, our level one lazy cheater

395
00:16:06.745 --> 00:16:09.365
who just didn't take the time to study, this is all stuff

396
00:16:09.365 --> 00:16:11.285
that's just available, right?

397
00:16:11.555 --> 00:16:13.965
When we were prepping for this, I actually, you know,

398
00:16:13.965 --> 00:16:15.645
started looking into this stuff myself.

399
00:16:16.015 --> 00:16:19.005
There are just so many YouTube videos out there about like,

400
00:16:19.145 --> 00:16:20.725
you can just go download the software

401
00:16:21.145 --> 00:16:23.245
and use it to cheat with links.

402
00:16:24.085 --> 00:16:25.525
Nobody's taking this stuff down.

403
00:16:25.555 --> 00:16:28.245
There's not a, there's not a online cheating

404
00:16:28.265 --> 00:16:29.405
police out there, right?

405
00:16:30.215 --> 00:16:31.565
There. There's not, and,

406
00:16:31.585 --> 00:16:34.765
and to an extent, it's, um, there are some things

407
00:16:34.765 --> 00:16:35.885
that you can police, right?

408
00:16:35.885 --> 00:16:38.005
You want to be able to police the things like, uh,

409
00:16:38.035 --> 00:16:40.325
content harvesting, like those content farms

410
00:16:40.325 --> 00:16:41.685
and data mining and all that stuff.

411
00:16:41.825 --> 00:16:45.995
But at the end of the day, is it really a cheating app?

412
00:16:46.625 --> 00:16:48.955
Like, like, what are you gonna use this app for?

413
00:16:48.955 --> 00:16:50.955
Maybe you have a legitimate purpose to hide a window.

414
00:16:51.555 --> 00:16:53.795
I don't know. So, so it's kind of a vague area,

415
00:16:53.905 --> 00:16:55.595
much less you're dealing with other countries

416
00:16:55.595 --> 00:16:56.955
and other, um, other legal

417
00:16:56.955 --> 00:16:58.195
rulings and all that stuff, right?

418
00:16:58.195 --> 00:17:00.075
So, but, but you're absolutely right.

419
00:17:00.145 --> 00:17:02.995
This is, I'm, I'm just, uh, I'm just sticking the things

420
00:17:02.995 --> 00:17:04.635
that are kind of publicly available here

421
00:17:04.635 --> 00:17:07.155
that you wanna make sure that you're, your,

422
00:17:07.225 --> 00:17:09.435
your secure delivery if you care about this stuff

423
00:17:09.435 --> 00:17:10.915
that you're using, a secure browser

424
00:17:10.935 --> 00:17:12.915
or some kind of secure mechanism that is

425
00:17:13.875 --> 00:17:15.235
actively monitoring for these type of things.

426
00:17:15.295 --> 00:17:17.675
Now, again, right? What I'm showing is just base run

427
00:17:17.675 --> 00:17:20.275
of the mill, like you said, can be downloaded anywhere.

428
00:17:20.525 --> 00:17:22.115
We're not doing anything groundbreaking here.

429
00:17:22.265 --> 00:17:24.995
It's just kind of just making people aware.

430
00:17:25.775 --> 00:17:28.595
So we have a question, uh, that, uh, that came in.

431
00:17:28.895 --> 00:17:29.915
The question is, uh,

432
00:17:30.135 --> 00:17:33.955
do lockdown browsers not detect apps like invis wind?

433
00:17:35.155 --> 00:17:37.615
So, so there's two points to

434
00:17:37.615 --> 00:17:39.055
that specific question, right?

435
00:17:39.305 --> 00:17:41.935
Invis win didn't need to even be running. All right?

436
00:17:42.335 --> 00:17:44.295
I just needed to start it up before my exam

437
00:17:44.475 --> 00:17:46.575
and get my code running in Microsoft Edge

438
00:17:46.595 --> 00:17:47.655
before I could even do it.

439
00:17:47.655 --> 00:17:49.885
Now again, I said my code, I didn't do anything.

440
00:17:50.065 --> 00:17:52.045
I'm just a user to download an executable

441
00:17:52.045 --> 00:17:53.925
and click two buttons to hide the thing.

442
00:17:54.105 --> 00:17:57.125
All right? So it doesn't matter if, if, uh,

443
00:17:57.315 --> 00:17:59.525
like if if Invis wind is still running, that's

444
00:17:59.645 --> 00:18:01.445
'cause the user was sloppy and they forgot to close it,

445
00:18:01.445 --> 00:18:02.845
it does not need to be running right there.

446
00:18:03.305 --> 00:18:07.685
The, the second point of that is, as you saw, it is possible

447
00:18:07.685 --> 00:18:09.925
to hide stuff from an operating system, right?

448
00:18:09.985 --> 00:18:13.845
So you need to be thinking creatively about all the

449
00:18:13.845 --> 00:18:15.125
different ways you can do this, right?

450
00:18:15.485 --> 00:18:17.725
Security in depth, that, that kind of concept.

451
00:18:17.905 --> 00:18:20.085
You wanna make sure that you're checking these things 10,

452
00:18:20.085 --> 00:18:21.885
20 different ways to make sure

453
00:18:21.885 --> 00:18:24.405
that everything is just working as you would expect it to.

454
00:18:25.305 --> 00:18:28.765
And I would just add that, uh, detecting running processes

455
00:18:29.345 --> 00:18:31.165
is a baseline requirement.

456
00:18:31.235 --> 00:18:33.045
It's, it's feature number one, right?

457
00:18:33.105 --> 00:18:34.405
For all secure browsers.

458
00:18:34.405 --> 00:18:36.645
Like, let's, let's make sure there aren't, you know,

459
00:18:36.645 --> 00:18:40.765
processes running that we know are, are, uh, uh, malicious,

460
00:18:40.825 --> 00:18:43.765
but as you said, sometimes the these are not.

461
00:18:44.785 --> 00:18:48.165
Um, so let, let's move on to, uh,

462
00:18:50.045 --> 00:18:52.255
cheater level number two.

463
00:18:52.985 --> 00:18:55.215
Let's talk about, uh, people

464
00:18:55.245 --> 00:18:59.655
that have put a significant amount of time into an app

465
00:18:59.655 --> 00:19:01.935
that is specifically for cheating.

466
00:19:02.565 --> 00:19:04.735
They make it publicly available.

467
00:19:05.195 --> 00:19:08.495
So we're not talking about invis wind, which is general, uh,

468
00:19:08.795 --> 00:19:10.975
or, uh, stuffer hiding processes,

469
00:19:10.975 --> 00:19:13.655
which could also be general, but a real cheating app.

470
00:19:13.685 --> 00:19:15.015
What does, what does that look like,

471
00:19:16.205 --> 00:19:17.205
Man? So

472
00:19:17.205 --> 00:19:19.235
I feel like it's gonna be hard

473
00:19:19.235 --> 00:19:20.795
to define a real cheating app

474
00:19:20.795 --> 00:19:23.355
because you can always creatively define a real

475
00:19:23.355 --> 00:19:24.435
life use case for it.

476
00:19:24.435 --> 00:19:25.635
Sure, that is not cheating, right?

477
00:19:25.695 --> 00:19:27.635
But sometimes it's just like, come on.

478
00:19:27.635 --> 00:19:29.835
Like, what, what else are you gonna use this thing for?

479
00:19:30.015 --> 00:19:33.195
So, um, so, uh, one that one that, uh,

480
00:19:33.235 --> 00:19:35.755
I came across a while ago, which was pretty interesting,

481
00:19:35.755 --> 00:19:38.115
was an, uh, an application called Chat, NCL.

482
00:19:38.895 --> 00:19:43.275
Um, and so what that application did, was it actually, uh,

483
00:19:43.375 --> 00:19:45.795
so the concept is it runs kind of silently,

484
00:19:45.855 --> 00:19:47.035
it runs in the background,

485
00:19:47.695 --> 00:19:51.035
and what it does is it uses kind of hotkeys in order

486
00:19:51.055 --> 00:19:52.955
to execute some AI attacks.

487
00:19:53.215 --> 00:19:55.675
So, and the one that we just talked about that really kind

488
00:19:55.675 --> 00:19:58.955
of rudimentary attack where I'm using an actual go like UI

489
00:19:58.975 --> 00:20:00.195
and using Chat GPT

490
00:20:00.195 --> 00:20:02.075
and asking it, this is more just kind

491
00:20:02.075 --> 00:20:03.715
of getting content off the screen

492
00:20:04.175 --> 00:20:07.315
and silently sending it off to an LLM

493
00:20:07.535 --> 00:20:10.945
and then getting the response back and putting it in, right?

494
00:20:10.965 --> 00:20:12.305
So that, that's kind of the concept.

495
00:20:12.445 --> 00:20:17.165
And so if we go and take a look at it here, so again,

496
00:20:17.165 --> 00:20:18.805
everything we wanna do is just, we're just kind

497
00:20:18.805 --> 00:20:20.805
of talking about this stuff is publicly

498
00:20:20.805 --> 00:20:21.925
available, all right?

499
00:20:21.925 --> 00:20:24.285
We're not doing anything that's, uh, crazy here.

500
00:20:24.385 --> 00:20:27.885
So if we go back to our good old Google over here and we go

501
00:20:27.885 --> 00:20:31.245
and find this application, so Chat NCL, right?

502
00:20:31.305 --> 00:20:32.485
See, it's publicly available

503
00:20:32.625 --> 00:20:34.565
and right on here, unlock the power chat

504
00:20:34.685 --> 00:20:35.725
CPT on your desktop.

505
00:20:35.955 --> 00:20:40.765
Okay? So the idea here is that it can run silently

506
00:20:40.945 --> 00:20:42.485
and it's going to just answer.

507
00:20:42.545 --> 00:20:44.405
So you can see in this example right here,

508
00:20:44.755 --> 00:20:48.925
they're actually just using a, uh, a Mac OS notepad here,

509
00:20:49.385 --> 00:20:51.525
and they're just typing in a question to it,

510
00:20:51.945 --> 00:20:53.685
and then it's gonna answer it right in there.

511
00:20:53.745 --> 00:20:56.405
So imagine that you're in a test, you're on an essay item

512
00:20:56.825 --> 00:20:58.485
and you just hit this hotkey,

513
00:20:58.585 --> 00:21:00.525
and now all of a sudden it's filling out the

514
00:21:00.535 --> 00:21:01.765
essay for you, right?

515
00:21:01.865 --> 00:21:04.485
That's the idea behind this attack. All right?

516
00:21:04.705 --> 00:21:06.765
And if we go and we look at how it works here,

517
00:21:08.105 --> 00:21:09.965
we can actually take a look at their site here.

518
00:21:09.965 --> 00:21:11.005
And so you can see it, they're,

519
00:21:11.005 --> 00:21:12.325
they're advertising it right here.

520
00:21:12.465 --> 00:21:14.885
And so they're in some kind of test right here.

521
00:21:14.915 --> 00:21:16.525
They're typing out the question

522
00:21:16.545 --> 00:21:17.605
and then they're gonna hit a

523
00:21:17.605 --> 00:21:19.165
hotkey and then it's gonna work.

524
00:21:19.865 --> 00:21:21.525
And so the other thing

525
00:21:21.525 --> 00:21:23.805
that I thought was like really interesting about this

526
00:21:24.405 --> 00:21:26.965
is the user friendliness of this thing, alright?

527
00:21:27.225 --> 00:21:30.165
If you go and you look at their setup application right

528
00:21:30.165 --> 00:21:31.805
here, this is the first thing you do,

529
00:21:31.805 --> 00:21:34.245
they make this very intuitive use.

530
00:21:34.355 --> 00:21:36.285
It's, it's actually a really nice interface.

531
00:21:36.385 --> 00:21:39.365
So you download their application and you launch it,

532
00:21:39.425 --> 00:21:40.805
and then the first thing you do is you

533
00:21:40.955 --> 00:21:42.565
customize your hotkeys, right?

534
00:21:42.985 --> 00:21:45.085
And so that's again, like, so if you have a secure browser

535
00:21:45.145 --> 00:21:46.645
and you're monitoring for certain hotkey

536
00:21:46.645 --> 00:21:48.325
to see if somebody's pressing it, well,

537
00:21:48.385 --> 00:21:50.285
you can actually customize these things, right?

538
00:21:50.305 --> 00:21:52.525
And so anybody can use any hotkeys they want.

539
00:21:52.545 --> 00:21:55.165
And so you have one that's going to get the information

540
00:21:55.165 --> 00:21:57.605
and send it to Chat GPT print the response,

541
00:21:57.615 --> 00:21:59.885
clear the conversation, um, those type

542
00:21:59.885 --> 00:22:01.965
of things like a full management system, all right?

543
00:22:01.965 --> 00:22:04.045
Here, a very intuitive user interface.

544
00:22:04.465 --> 00:22:06.605
And then after you set all that up, the next thing

545
00:22:06.605 --> 00:22:09.165
that you do is you're going to give it your, um,

546
00:22:09.355 --> 00:22:10.925
your API key, alright?

547
00:22:10.925 --> 00:22:12.165
Well, not your API key,

548
00:22:12.165 --> 00:22:15.245
but basically they rent this thing by the hour, okay?

549
00:22:15.245 --> 00:22:17.085
So if you go back to their pricing over here

550
00:22:17.545 --> 00:22:20.045
and we just scroll down, you'll see, like, look at this,

551
00:22:20.045 --> 00:22:22.005
this is a nice professional looking webpage.

552
00:22:22.005 --> 00:22:23.805
They put a lot of effort into this product,

553
00:22:24.545 --> 00:22:27.235
and you could see the pricing somewhere right here.

554
00:22:27.255 --> 00:22:28.915
So you see, they, they have these different

555
00:22:28.915 --> 00:22:29.995
pricing plans, right?

556
00:22:30.015 --> 00:22:31.515
So you can use their application

557
00:22:31.515 --> 00:22:33.075
for one hour, two hour, four hours.

558
00:22:33.535 --> 00:22:35.755
Uh, and it was, and it was really interesting, I was,

559
00:22:35.795 --> 00:22:37.435
I was trying to look at the application

560
00:22:37.615 --> 00:22:39.355
and just seeing how much they're running client

561
00:22:39.355 --> 00:22:40.395
side and those type of things.

562
00:22:40.415 --> 00:22:42.075
And they have a little kill switch in there.

563
00:22:42.135 --> 00:22:43.995
So if you try to, if you try to watch

564
00:22:43.995 --> 00:22:45.035
what it's doing over the network

565
00:22:45.035 --> 00:22:48.035
through a proxy application, they'll actually kill itself.

566
00:22:48.135 --> 00:22:49.315
Um, they're, they're just doing that

567
00:22:49.315 --> 00:22:50.955
by reading the registry, but I thought, I thought

568
00:22:50.955 --> 00:22:51.995
that was kind of interesting.

569
00:22:52.215 --> 00:22:53.635
But you can see that they're packaging it

570
00:22:53.635 --> 00:22:54.755
and they're making intuitive

571
00:22:54.755 --> 00:22:57.235
and they're making it easy to use for people to go.

572
00:22:57.295 --> 00:22:59.355
So again, you don't need to be something very,

573
00:22:59.535 --> 00:23:01.675
you don't need to be somebody very knowledgeable in

574
00:23:01.875 --> 00:23:04.795
computers and APIs and all of that nonsense, right?

575
00:23:04.855 --> 00:23:08.195
You just need to be somebody with $15 that, uh,

576
00:23:08.215 --> 00:23:11.355
can set up a quick settings application to run some hotkey.

577
00:23:12.225 --> 00:23:15.565
So for this application, the idea is, uh,

578
00:23:15.945 --> 00:23:18.885
you would just highlight something, hit a hot key,

579
00:23:19.105 --> 00:23:22.005
it gets sent off to Chat, GPT chat,

580
00:23:22.285 --> 00:23:26.245
GPT being the helpful robot that it is answers the question.

581
00:23:26.745 --> 00:23:28.005
You press another hot key

582
00:23:28.005 --> 00:23:30.325
and that gets pasted into whatever window you have open,

583
00:23:30.795 --> 00:23:33.205
such as an online exam. Is that right?

584
00:23:33.705 --> 00:23:34.885
That's exactly right.

585
00:23:35.065 --> 00:23:36.845
And so, so, so that's

586
00:23:36.845 --> 00:23:38.965
how this specific application works, all right?

587
00:23:39.025 --> 00:23:42.245
And they even added a recent feature, um, also, which is

588
00:23:42.245 --> 00:23:44.085
to actually capture the screen content.

589
00:23:44.545 --> 00:23:47.085
So that way you don't have to actually type in the question

590
00:23:47.145 --> 00:23:48.805
or highlight any text or anything like that.

591
00:23:48.825 --> 00:23:50.005
It just takes a screenshot.

592
00:23:50.265 --> 00:23:52.165
And then that screenshot will go off the chat,

593
00:23:52.305 --> 00:23:54.205
the open AI under the covers, right?

594
00:23:54.205 --> 00:23:56.205
It goes off to, we'll just call it Chat GPT,

595
00:23:56.205 --> 00:23:58.405
but you send it off to Chat GPT

596
00:23:58.625 --> 00:24:00.245
and it'll answer for you and comes back, right?

597
00:24:00.465 --> 00:24:02.765
And, um, so just for clarity, we know chat,

598
00:24:03.045 --> 00:24:04.325
GBT is an application.

599
00:24:04.355 --> 00:24:06.765
It's the open AI API set that you're using under it.

600
00:24:06.765 --> 00:24:09.005
But for the purpose of this, we'll just keep referencing

601
00:24:09.005 --> 00:24:10.925
that whole magical Chat GPT box,

602
00:24:10.925 --> 00:24:12.165
right? Keep things simple here.

603
00:24:12.865 --> 00:24:15.245
So, uh, we had a question, uh, come in, Chris,

604
00:24:16.025 --> 00:24:18.005
do test vendors track hotkey

605
00:24:18.145 --> 00:24:20.045
and report that back to the client?

606
00:24:20.585 --> 00:24:22.965
Or are those hotkeys instantly blocked?

607
00:24:24.175 --> 00:24:27.075
So it's going, it's, it's a really interesting question.

608
00:24:27.075 --> 00:24:28.955
There's a lot of variables to that.

609
00:24:29.215 --> 00:24:33.075
Um, there you can, it's really gonna depend on what,

610
00:24:33.225 --> 00:24:34.475
what your vendor wants to do,

611
00:24:34.545 --> 00:24:36.795
what you're comfortable doing and what makes sense.

612
00:24:36.855 --> 00:24:38.595
And so let me give a couple examples there.

613
00:24:38.935 --> 00:24:43.515
So tracking hotkey in order to track hotkey, okay, well,

614
00:24:43.515 --> 00:24:45.115
you're gonna install a key listener, right?

615
00:24:45.115 --> 00:24:46.115
Because you need to know that it's

616
00:24:46.115 --> 00:24:47.035
hotkeys are getting pressed.

617
00:24:47.035 --> 00:24:49.435
And then it's like, well, what hotkey are you pressing?

618
00:24:49.435 --> 00:24:50.595
Because at the end of the day,

619
00:24:51.135 --> 00:24:52.795
you can make your own application

620
00:24:52.865 --> 00:24:55.795
that can just fire off if you hit a certain key

621
00:24:55.795 --> 00:24:57.235
that is just rarely used, right?

622
00:24:57.615 --> 00:24:58.835
You can do those type of things.

623
00:24:58.895 --> 00:25:00.795
Or maybe you do shift AA twice, right?

624
00:25:01.135 --> 00:25:03.595
Do key strings instead of hotkey specifically.

625
00:25:03.895 --> 00:25:05.755
So there's those things to think about, right?

626
00:25:06.015 --> 00:25:07.875
Um, the other thing you wanna think about is, well,

627
00:25:07.875 --> 00:25:10.435
maybe you're do, maybe you're a test delivery application

628
00:25:10.435 --> 00:25:13.875
that's actually doing some in-app based testing, right?

629
00:25:14.055 --> 00:25:16.075
And so you're using this other software

630
00:25:16.075 --> 00:25:17.835
and you're testing to make sure the user knows

631
00:25:17.835 --> 00:25:20.035
that software well, that user's going to need

632
00:25:20.035 --> 00:25:21.835
to use hotkeys for those type of things, right?

633
00:25:21.835 --> 00:25:23.595
So you're just gonna blanket block hotkey

634
00:25:23.615 --> 00:25:24.995
or are you gonna do those type of things,

635
00:25:25.295 --> 00:25:27.195
or you gonna a key log or, and monitor that?

636
00:25:27.495 --> 00:25:28.835
And, and, um, there's really,

637
00:25:28.835 --> 00:25:30.355
there's really no one answer to this.

638
00:25:30.455 --> 00:25:32.595
Um, there, there's a lot of things to think about, um,

639
00:25:32.895 --> 00:25:34.835
but kind of, kind of get into the idea

640
00:25:34.975 --> 00:25:37.275
of blocking an attack like this, right?

641
00:25:37.505 --> 00:25:38.595
It's important to understand

642
00:25:38.735 --> 00:25:40.795
how exactly is this attack even working?

643
00:25:41.055 --> 00:25:42.315
And if you think about it,

644
00:25:42.335 --> 00:25:45.235
it breaks down into three key pieces of there,

645
00:25:45.235 --> 00:25:48.275
there's three main pieces to this attack, which is cool

646
00:25:48.275 --> 00:25:50.115
because that gives you three chances to break it.

647
00:25:50.315 --> 00:25:52.155
'cause each, each step is dependent on the

648
00:25:52.355 --> 00:25:53.435
previous step, okay?

649
00:25:53.815 --> 00:25:57.435
So the first step is getting the item, getting the question

650
00:25:57.505 --> 00:25:59.395
that you need to send off to the robot.

651
00:25:59.425 --> 00:26:01.395
Alright? So how do you get that?

652
00:26:01.745 --> 00:26:02.995
Well, there's a coup, there's

653
00:26:02.995 --> 00:26:04.035
a lot of different ways you can do that.

654
00:26:04.035 --> 00:26:05.715
And people can get really creative, right?

655
00:26:05.975 --> 00:26:07.475
Uh, you can go the physical route

656
00:26:07.475 --> 00:26:09.275
where you're wearing a camera and those type of things.

657
00:26:09.275 --> 00:26:10.795
And it's like if you, once you get in the physical,

658
00:26:10.965 --> 00:26:13.595
we'll just, we'll just kind of set that conversation aside.

659
00:26:13.615 --> 00:26:15.155
So, right? So just thinking about kind

660
00:26:15.155 --> 00:26:16.795
of software based stuff, how can I get it?

661
00:26:16.825 --> 00:26:19.475
Well, maybe I can just take a picture of the screen

662
00:26:19.475 --> 00:26:20.675
through a hotkey, right?

663
00:26:20.775 --> 00:26:21.915
That's one way I can do it.

664
00:26:21.915 --> 00:26:24.075
Or, or a key string hotkey or a key string.

665
00:26:24.335 --> 00:26:26.995
Or maybe what I could do is I can utilize some, uh,

666
00:26:26.995 --> 00:26:28.595
accessibility interfaces, right?

667
00:26:28.855 --> 00:26:31.075
So if you think about applications like JAWS

668
00:26:31.075 --> 00:26:33.515
and those type of things, well, they're able

669
00:26:33.515 --> 00:26:35.115
to get the text off the screen, all right?

670
00:26:35.115 --> 00:26:36.115
Well, if they're able to do it,

671
00:26:36.115 --> 00:26:37.795
and then another program's able to do it, right?

672
00:26:37.815 --> 00:26:40.675
So can, can you exploit those type of accessibility, inform,

673
00:26:40.695 --> 00:26:43.325
uh, interfaces to get that type of information?

674
00:26:43.325 --> 00:26:45.525
Alright? So that's, that's,

675
00:26:45.625 --> 00:26:47.965
and I think that this application is probably using

676
00:26:48.115 --> 00:26:49.685
accessibility, if I had to guess.

677
00:26:49.745 --> 00:26:51.725
Now, they, they added a screenshot feature too,

678
00:26:52.065 --> 00:26:54.565
but, um, that those are some ways that they could do it.

679
00:26:54.565 --> 00:26:56.005
All right? So, so the step one is

680
00:26:56.005 --> 00:26:57.045
getting the data, all right?

681
00:26:57.145 --> 00:26:58.525
And so you wanna make sure, like, okay,

682
00:26:58.585 --> 00:26:59.765
can I shut down that vector?

683
00:26:59.865 --> 00:27:01.205
How can I stop those things?

684
00:27:01.535 --> 00:27:03.285
Limit accessibility to just the people

685
00:27:03.285 --> 00:27:04.365
that are approved to use it.

686
00:27:04.365 --> 00:27:06.845
Make sure that you can't take a screenshot those times.

687
00:27:06.895 --> 00:27:08.005
Block it that way, right?

688
00:27:08.145 --> 00:27:11.125
And you can always just look for a process called Chat NCL l

689
00:27:11.145 --> 00:27:12.845
or I think they call El Lucifer on here.

690
00:27:13.025 --> 00:27:15.165
You can, you can try to block it at the process level too.

691
00:27:15.165 --> 00:27:18.045
It's, it's gonna be how much, what, what road you want

692
00:27:18.045 --> 00:27:19.445
to go down to block, something like that, right?

693
00:27:19.625 --> 00:27:21.365
So if you're able to stop the information,

694
00:27:21.385 --> 00:27:22.765
you've killed the attack right there,

695
00:27:22.765 --> 00:27:24.525
they can't get the data, they're not gonna,

696
00:27:24.525 --> 00:27:26.405
they're not even gonna get the step two and step three.

697
00:27:26.435 --> 00:27:30.085
Alright? So step two, getting the data up and back, right?

698
00:27:30.105 --> 00:27:32.365
So now, now let's just say that they've gotten the data.

699
00:27:32.705 --> 00:27:34.765
The second part to that attack is, well, now they need

700
00:27:34.765 --> 00:27:36.045
to get the answer to that question,

701
00:27:36.045 --> 00:27:37.685
whether they're sending off the screenshot

702
00:27:37.685 --> 00:27:39.005
or they're sending that, right?

703
00:27:39.385 --> 00:27:41.685
So that's going to be some network traffic.

704
00:27:41.945 --> 00:27:44.365
If they're using, uh, an open AI interface

705
00:27:44.385 --> 00:27:47.365
or some other LLM out there that an an online LLM,

706
00:27:47.435 --> 00:27:49.605
they're gonna send that information up and back.

707
00:27:49.605 --> 00:27:51.925
Right? Now, that's not the only way to do something like

708
00:27:51.925 --> 00:27:53.005
that, but that's, that's there.

709
00:27:53.005 --> 00:27:55.245
So monitoring traffic, right?

710
00:27:55.465 --> 00:27:57.125
Now, what's important to realize is that

711
00:27:57.125 --> 00:27:59.085
that web traffic is happening outside

712
00:27:59.085 --> 00:28:00.365
of your secure testing app.

713
00:28:00.465 --> 00:28:01.885
So it's not something if,

714
00:28:01.945 --> 00:28:03.365
if you're just monitoring all the app,

715
00:28:03.365 --> 00:28:04.845
all the network traffic that's happening

716
00:28:04.845 --> 00:28:05.845
inside your application,

717
00:28:05.845 --> 00:28:07.445
you're not gonna catch something like that, right?

718
00:28:07.625 --> 00:28:09.285
You need to think more holistically, right?

719
00:28:09.625 --> 00:28:12.635
If, if you wanna try to go that route of,

720
00:28:12.895 --> 00:28:14.395
of monitoring the traffic, well,

721
00:28:14.395 --> 00:28:15.915
how would you do something like that, right?

722
00:28:15.975 --> 00:28:17.475
You need to look at it from that perspective.

723
00:28:18.685 --> 00:28:20.705
Now, let's say that they get the information up

724
00:28:20.705 --> 00:28:23.785
and back, the third most important piece to this attack

725
00:28:24.485 --> 00:28:26.785
is getting the answer back to the user, right?

726
00:28:27.085 --> 00:28:28.425
It doesn't matter if they got it

727
00:28:28.425 --> 00:28:29.465
and they got the answer, well,

728
00:28:29.465 --> 00:28:30.465
how are you gonna get it on the screen?

729
00:28:30.465 --> 00:28:31.825
Right? And this is where you gotta get

730
00:28:31.825 --> 00:28:33.025
really creative, right?

731
00:28:33.295 --> 00:28:35.465
Because what are you gonna do?

732
00:28:35.525 --> 00:28:38.585
Are you gonna just kind of utilize some kind of interface

733
00:28:38.585 --> 00:28:40.505
that's gonna find the radio button on the screen

734
00:28:40.505 --> 00:28:43.945
and check it or kind of type or, or this

735
00:28:44.005 --> 00:28:45.345
or play audio, right?

736
00:28:45.525 --> 00:28:47.305
And if you think about it, realistically,

737
00:28:47.445 --> 00:28:49.825
if you're playing audio that has the answer back

738
00:28:49.825 --> 00:28:53.025
to the person, the the proctor's gonna hear something like

739
00:28:53.265 --> 00:28:54.385
that if they're watching it, right?

740
00:28:54.725 --> 00:28:58.185
Um, now I think what this app was doing, they were probably,

741
00:28:58.285 --> 00:29:00.105
my guess is they were probably using send keys.

742
00:29:00.335 --> 00:29:02.505
Like, uh, so they're using a Windows interface

743
00:29:02.505 --> 00:29:04.465
that actually just injects,

744
00:29:04.695 --> 00:29:07.305
injects characters onto an element on the screen.

745
00:29:07.745 --> 00:29:08.905
I think that's probably what they were doing.

746
00:29:08.905 --> 00:29:10.665
There's a bunch of different ways you could do that.

747
00:29:10.965 --> 00:29:12.345
So that's another way if,

748
00:29:12.405 --> 00:29:13.625
and that will really only work

749
00:29:13.625 --> 00:29:15.105
for essay type questions, right?

750
00:29:15.365 --> 00:29:18.105
And so, so you have your accessibility interfaces, you have,

751
00:29:18.105 --> 00:29:19.185
um, those type of things.

752
00:29:19.485 --> 00:29:22.265
And so people can get creative around those things,

753
00:29:22.285 --> 00:29:24.105
and it's really just kind of monitoring it

754
00:29:24.105 --> 00:29:25.505
and looking for that, the getting

755
00:29:25.505 --> 00:29:26.585
that information back, right?

756
00:29:26.605 --> 00:29:28.785
So, so ev so they have to,

757
00:29:29.045 --> 00:29:31.225
so usually the hacker has it easy,

758
00:29:31.285 --> 00:29:34.305
but here, in this case, you have three chances to block 'em.

759
00:29:34.305 --> 00:29:36.025
And if you succeed in any one of those three,

760
00:29:36.445 --> 00:29:38.145
you've stopped the attack, right?

761
00:29:38.215 --> 00:29:40.585
They need all three of these to succeed in order

762
00:29:40.585 --> 00:29:43.485
for this attack to work where there, whereas this, whereas

763
00:29:44.005 --> 00:29:45.445
somebody who's trying to protect their test

764
00:29:45.865 --> 00:29:47.445
and, uh, make sure that people aren't cheating,

765
00:29:47.505 --> 00:29:49.285
you only need to block one of those three things.

766
00:29:51.245 --> 00:29:54.105
So, uh, again, uh, to, so for mitigation

767
00:29:54.285 --> 00:29:57.865
for a level two cheater, I, I think the answer is again, uh,

768
00:29:58.445 --> 00:30:01.265
you know, th this needs to be things that your secure,

769
00:30:01.365 --> 00:30:03.665
secure browser can, uh, address.

770
00:30:03.925 --> 00:30:07.425
And, uh, like with all security, there's, you know, you need

771
00:30:07.425 --> 00:30:09.665
to stop things on, on multiple levels. Is that right?

772
00:30:10.445 --> 00:30:15.375
Yes. Yep. Alright, let's move on then to,

773
00:30:16.035 --> 00:30:17.975
uh, the level three cheater.

774
00:30:18.235 --> 00:30:21.295
Um, this is the, the cheater for hire.

775
00:30:21.515 --> 00:30:26.415
So, um, this can be, uh, a person who's worked in, uh,

776
00:30:26.665 --> 00:30:29.135
innovative technologies for several years

777
00:30:29.355 --> 00:30:31.535
and decides he he wants to break bad

778
00:30:31.675 --> 00:30:34.375
and, you know, start, uh, helping people cheat instead of,

779
00:30:34.795 --> 00:30:36.175
uh, being a force for good.

780
00:30:36.715 --> 00:30:39.695
Uh, if someone was to go hire someone like this

781
00:30:40.275 --> 00:30:43.455
and this person for, you know, a much half

782
00:30:43.455 --> 00:30:44.775
to your fee than just a download

783
00:30:44.775 --> 00:30:48.735
of a software will customize a cheating experience just

784
00:30:48.755 --> 00:30:51.695
for you, the, the tailor made cheating experience,

785
00:30:52.035 --> 00:30:53.215
uh, what might that look like?

786
00:30:54.085 --> 00:30:56.815
Yeah. So that could look like a whole bunch

787
00:30:56.815 --> 00:30:58.735
of different other, uh, different things, right?

788
00:30:59.075 --> 00:31:03.175
Um, what's the, if, if I was going to provide something like

789
00:31:03.175 --> 00:31:05.855
that, I wouldn't even bother with AI to begin with, right?

790
00:31:05.935 --> 00:31:07.775
I, I go with the proxy testing route.

791
00:31:08.035 --> 00:31:10.415
How can I get something running inside a virtual machine

792
00:31:10.415 --> 00:31:11.775
or through screen sharing software, right?

793
00:31:11.775 --> 00:31:14.135
That's gonna be easiest. And then I'll just do all the

794
00:31:14.295 --> 00:31:15.895
cheating on my end, whether I know the content

795
00:31:15.955 --> 00:31:16.975
or whether I'm looking it up

796
00:31:16.975 --> 00:31:18.735
as the test goes, I'll do something like that.

797
00:31:18.735 --> 00:31:20.055
But we're here to talk about ai,

798
00:31:20.055 --> 00:31:21.615
so we're not gonna go down those roads, right?

799
00:31:21.795 --> 00:31:23.895
But there's never just one answer to a problem.

800
00:31:24.435 --> 00:31:27.375
So what, what, what that would kind of look like,

801
00:31:27.375 --> 00:31:28.455
would probably, you would probably,

802
00:31:28.635 --> 00:31:29.935
one thing you could do is kind of take

803
00:31:29.935 --> 00:31:32.015
that Chat NCL application and kind of,

804
00:31:32.275 --> 00:31:33.735
and kind of homegrown it, right?

805
00:31:34.035 --> 00:31:35.535
Try to do a couple more things to it.

806
00:31:35.595 --> 00:31:38.495
And so just to kind of give an idea here, I can show,

807
00:31:38.675 --> 00:31:40.255
so we have this homegrown app that,

808
00:31:40.255 --> 00:31:42.795
that we've made here, all right?

809
00:31:42.795 --> 00:31:46.345
And I'll share my screen one more time. All right.

810
00:31:46.405 --> 00:31:48.785
So what I'm gonna do is just kind of launch my application.

811
00:31:48.785 --> 00:31:51.185
So this is just like the, the Chat NCL

812
00:31:51.185 --> 00:31:52.425
that we were just looking at, right?

813
00:31:52.865 --> 00:31:55.785
And I have my test here. And so what I've done is basically,

814
00:31:55.785 --> 00:31:56.785
Uh, Chris, I don't see your screen

815
00:31:57.045 --> 00:31:58.045
Yet. You don't see my

816
00:31:58.045 --> 00:31:59.345
screen? All right. Lemme try. Nope.

817
00:31:59.345 --> 00:32:01.145
Oh, 'cause I didn't, I didn't hit the share button.

818
00:32:01.405 --> 00:32:03.665
All right, there we go. Okay, cool. All right.

819
00:32:03.805 --> 00:32:06.385
So I have my, I have my testing application here.

820
00:32:09.925 --> 00:32:12.225
All, lemme get rid of that thing. There we go. All right.

821
00:32:12.245 --> 00:32:15.585
So now I should just be able to kind of hit a hot key

822
00:32:15.605 --> 00:32:20.105
and then it's going to kind of run, all right?

823
00:32:20.615 --> 00:32:23.265
Okay. All right. Ah, it's 'cause I'm doing the screen share.

824
00:32:23.365 --> 00:32:26.105
All right. So, so this is a great example here though.

825
00:32:26.105 --> 00:32:27.825
So even though it's not working right here, it's not,

826
00:32:27.865 --> 00:32:28.905
I know exactly why it's not working.

827
00:32:28.935 --> 00:32:30.545
It's not working because there's screen share

828
00:32:30.545 --> 00:32:31.785
interface on top of the test.

829
00:32:32.045 --> 00:32:35.985
So as a, so let's just say that, okay, that is what,

830
00:32:35.985 --> 00:32:38.945
that is the gap that that Chat NCL application had, okay?

831
00:32:39.385 --> 00:32:42.365
So what I could do as a homegrown hacker is I can actually

832
00:32:42.365 --> 00:32:45.165
tailor make my solution to that, right?

833
00:32:45.565 --> 00:32:48.085
I can take into all the accounts that this secure testing,

834
00:32:48.155 --> 00:32:50.445
that this test is gonna be delivered in a secure interface.

835
00:32:50.545 --> 00:32:51.565
And I could take a concept

836
00:32:51.575 --> 00:32:54.445
where I'm gonna call open AI APIs under the cover and,

837
00:32:54.445 --> 00:32:56.085
and put together custom hotkey

838
00:32:56.425 --> 00:32:58.565
and make it so that I'm gonna leverage whatever

839
00:32:58.565 --> 00:32:59.885
that secure browser isn't,

840
00:33:00.085 --> 00:33:02.005
whatever vectors aren't being shut down there, right?

841
00:33:02.305 --> 00:33:03.965
And make it so that way, okay, I know

842
00:33:03.965 --> 00:33:05.885
that this test is gonna have multiple choice questions,

843
00:33:06.165 --> 00:33:08.045
I know that it's gonna have reading passages, those type

844
00:33:08.045 --> 00:33:10.565
of things and tailor my solution to that, right?

845
00:33:10.785 --> 00:33:12.605
And then you could take it a step further, right?

846
00:33:12.665 --> 00:33:15.375
You could do these things where that

847
00:33:16.945 --> 00:33:21.765
you're not just going to online APIs, you can take it

848
00:33:21.765 --> 00:33:24.805
to another scenario and look off offline APIs, right?

849
00:33:24.805 --> 00:33:26.525
Maybe you don't want to have that network traffic.

850
00:33:26.585 --> 00:33:28.445
And so you can use things called s SLMs,

851
00:33:28.445 --> 00:33:30.605
those small language models, right?

852
00:33:30.815 --> 00:33:32.885
Which they're not gonna be as powerful, right?

853
00:33:32.885 --> 00:33:35.085
Those large language models, they're running online,

854
00:33:35.085 --> 00:33:37.085
they're trained on the entirety of the internet.

855
00:33:37.215 --> 00:33:39.525
These small language models, they're more optimized,

856
00:33:39.525 --> 00:33:40.605
they don't have all that knowledge.

857
00:33:40.605 --> 00:33:43.165
And so if you just hook it up to a small language model,

858
00:33:43.835 --> 00:33:46.205
it's probably not gonna be able to pass your test for you.

859
00:33:46.395 --> 00:33:48.885
It's, but it's gonna be great at being able to route things

860
00:33:49.025 --> 00:33:51.245
and, uh, get that, get that NLP interfaces,

861
00:33:51.245 --> 00:33:53.045
those natural language processing type

862
00:33:53.045 --> 00:33:54.205
of things going on, right?

863
00:33:54.745 --> 00:33:58.125
So, but you can make those SLM smarter, right?

864
00:33:58.345 --> 00:34:00.765
And we were getting into this in the last time we talked,

865
00:34:00.865 --> 00:34:02.205
um, so that, that rag,

866
00:34:02.205 --> 00:34:04.565
that retrieval augmented generation, right?

867
00:34:04.825 --> 00:34:07.005
So if you're building like a custom homegrown solution,

868
00:34:07.005 --> 00:34:08.525
maybe you're gonna look into something like that.

869
00:34:08.525 --> 00:34:10.885
Like, I know I'm gonna be taking a medical exam,

870
00:34:11.145 --> 00:34:13.645
so I'm gonna get all of my medical documents,

871
00:34:13.645 --> 00:34:14.765
throw 'em in a database,

872
00:34:15.105 --> 00:34:16.645
and then, uh, get it all set up

873
00:34:16.645 --> 00:34:17.685
with my embeddings and everything.

874
00:34:17.685 --> 00:34:22.085
So that way now I'm just gonna run A-A-S-L-M offline on my

875
00:34:22.325 --> 00:34:25.485
computer that's going to allow my, uh, my, uh,

876
00:34:25.665 --> 00:34:27.325
my dumber SLM, right?

877
00:34:27.325 --> 00:34:28.525
The one that doesn't have all the entire

878
00:34:28.525 --> 00:34:30.885
of the internet knowledge to be able to reference that.

879
00:34:30.905 --> 00:34:33.685
So it's gonna like, oh, I know the context of the question,

880
00:34:33.905 --> 00:34:36.245
I'm smart enough to go and at least get the additional data

881
00:34:36.305 --> 00:34:38.725
and then par that data in real time to figure out

882
00:34:38.725 --> 00:34:40.925
what the appropriate answer is gonna be right

883
00:34:41.425 --> 00:34:42.425
Now. Yeah. So in this case, the,

884
00:34:42.425 --> 00:34:45.125
in that case, the, the SLM,

885
00:34:45.185 --> 00:34:47.725
the AI software is really just responsible for

886
00:34:47.725 --> 00:34:49.205
that interaction, right?

887
00:34:49.475 --> 00:34:54.005
Like it, it knows what's in the database, it knows how

888
00:34:54.005 --> 00:34:56.485
to tell you in English what the right answer is

889
00:34:56.485 --> 00:34:58.125
or how to answer a question.

890
00:34:58.185 --> 00:35:00.965
So it's really just facilitating the transfer

891
00:35:00.965 --> 00:35:03.925
of knowledge from your database of knowledge to your test

892
00:35:03.945 --> 00:35:05.005
or to you directly, right?

893
00:35:05.425 --> 00:35:08.115
Yep. Exactly. Yep.

894
00:35:08.985 --> 00:35:11.795
It's, it's, it's, uh, it's, it's tightening up that,

895
00:35:11.825 --> 00:35:14.595
that level, that, that, that centerpiece of the attack,

896
00:35:14.615 --> 00:35:17.435
the step two, it's removing the whole network traffic from

897
00:35:17.435 --> 00:35:18.755
the equation and those type of things.

898
00:35:18.775 --> 00:35:21.995
And so, so, so if you're gonna go down that custom route,

899
00:35:21.995 --> 00:35:25.355
those are things that people can do to make sure to, to kind

900
00:35:25.355 --> 00:35:26.755
of build a better solution than what's,

901
00:35:26.755 --> 00:35:28.555
than what's just gonna be better off the shelf.

902
00:35:28.695 --> 00:35:31.075
So it's important to just stay, be vigilant

903
00:35:31.255 --> 00:35:32.635
of what's available out there

904
00:35:32.935 --> 00:35:35.475
and look at what these attacks, what, what, what type

905
00:35:35.475 --> 00:35:36.595
of attacks are being made,

906
00:35:36.775 --> 00:35:39.925
and then coming up with ways to, uh, block those things

907
00:35:40.065 --> 00:35:42.925
as well as thinking about how health can they be used

908
00:35:42.925 --> 00:35:44.445
or modified, and what do I,

909
00:35:44.445 --> 00:35:45.725
what else do I need to look out for?

910
00:35:47.785 --> 00:35:51.415
Great. Anything different, uh, for mitigating, uh, this,

911
00:35:51.525 --> 00:35:54.615
this attack over, you know, what we've already talked about.

912
00:35:55.935 --> 00:35:59.115
So if you're going to be looking for these type of things,

913
00:35:59.355 --> 00:36:01.635
I, I think focusing on step one

914
00:36:01.635 --> 00:36:04.515
and step three are gonna get a lot more bang for the buck.

915
00:36:04.775 --> 00:36:07.195
Um, step two is gonna be kind of hard, right?

916
00:36:07.195 --> 00:36:09.395
Like, there, there's going to be indicators, right?

917
00:36:09.395 --> 00:36:12.195
If it's a CPU based one, you're gonna see a spike there.

918
00:36:12.195 --> 00:36:14.155
If it's GPU based, uh, right?

919
00:36:14.155 --> 00:36:15.435
If you're running a GPU based,

920
00:36:15.545 --> 00:36:16.875
it's gonna be a spike there, right?

921
00:36:17.135 --> 00:36:18.955
And so there's, those are things you can infer.

922
00:36:18.955 --> 00:36:21.315
There's data collection, uh, techniques that you can do

923
00:36:21.315 --> 00:36:22.395
and monitor this stuff,

924
00:36:22.495 --> 00:36:25.155
but I really think the best bang for your buck is gonna be

925
00:36:25.715 --> 00:36:28.395
stopping them from either, uh, getting the data into,

926
00:36:28.505 --> 00:36:29.955
into the model and, uh,

927
00:36:30.155 --> 00:36:32.075
blocking the data from an output in from the model.

928
00:36:33.895 --> 00:36:37.935
Okay. Great. Um, we've got about

929
00:36:38.625 --> 00:36:41.535
eight minutes left, uh, and no open questions.

930
00:36:42.235 --> 00:36:46.335
Um, I have, I guess I have a follow up question for you.

931
00:36:46.875 --> 00:36:50.055
Um, these cheating applications, they're,

932
00:36:50.645 --> 00:36:52.695
they're suddenly everywhere, right?

933
00:36:53.395 --> 00:36:58.295
Um, how do you think AI has helped, uh, people that want

934
00:36:58.315 --> 00:36:59.975
to make cheating applications?

935
00:37:00.475 --> 00:37:02.175
Um, and spoiler earlier, I,

936
00:37:02.295 --> 00:37:03.375
I know the answer to this question.

937
00:37:03.575 --> 00:37:04.695
I'm a developer myself.

938
00:37:05.315 --> 00:37:08.535
How has AI helped make cheating applications?

939
00:37:08.635 --> 00:37:10.535
Why are they so, so much

940
00:37:10.535 --> 00:37:12.015
more prevalent now than they were before?

941
00:37:12.435 --> 00:37:14.055
Or why are they better now

942
00:37:14.055 --> 00:37:15.575
and more polished than they used to be?

943
00:37:16.145 --> 00:37:17.575
Right? Uh, no, I mean, I,

944
00:37:17.695 --> 00:37:19.535
I think both the things you said are true, right?

945
00:37:19.555 --> 00:37:20.615
Why are they more prevalent

946
00:37:20.615 --> 00:37:22.175
and why are they more polished, right?

947
00:37:22.245 --> 00:37:24.575
It's because you no longer need

948
00:37:24.575 --> 00:37:27.215
to be a code expert to develop these things.

949
00:37:27.275 --> 00:37:29.935
You need a base level understanding and,

950
00:37:30.275 --> 00:37:32.255
and AI can even help you get

951
00:37:32.255 --> 00:37:33.815
that base level understanding, right?

952
00:37:33.995 --> 00:37:37.575
The robot is being used to build the robot, right?

953
00:37:38.075 --> 00:37:40.655
So you can use it in a couple ways, right?

954
00:37:40.655 --> 00:37:43.015
You can use it to even give you ideas on how you're gonna,

955
00:37:43.075 --> 00:37:44.615
on how you're gonna do something, right?

956
00:37:44.995 --> 00:37:46.255
Um, you just gotta phrase it right?

957
00:37:46.255 --> 00:37:47.895
So that, 'cause they have safeguards in place,

958
00:37:47.915 --> 00:37:49.775
but right, there's always different ways

959
00:37:50.015 --> 00:37:51.175
you can ask the same question.

960
00:37:51.675 --> 00:37:52.735
Um, and, but,

961
00:37:52.795 --> 00:37:54.895
but really where it's coming in play, really, really

962
00:37:54.895 --> 00:37:57.375
where it's coming in handy is, is doing code reviews

963
00:37:57.395 --> 00:37:58.775
and writing unit tests for you.

964
00:37:58.795 --> 00:38:00.455
So if you're actually trying

965
00:38:00.455 --> 00:38:02.815
to put out a good quality cheating application,

966
00:38:03.115 --> 00:38:05.975
you no longer need a, a team of experienced developers.

967
00:38:05.975 --> 00:38:07.175
It could be a single person

968
00:38:07.555 --> 00:38:10.535
that's just having the robot do the code reviews for 'em,

969
00:38:10.535 --> 00:38:12.295
or calling out spots where their code might fail

970
00:38:12.295 --> 00:38:15.015
and crash on them and really helping them to create a,

971
00:38:15.055 --> 00:38:16.575
a better, more stable product.

972
00:38:17.115 --> 00:38:19.895
Um, it, it's like having a, a junior

973
00:38:19.955 --> 00:38:21.575
to senior level developer, depending on

974
00:38:21.575 --> 00:38:23.255
what model you're using right at your fingertips,

975
00:38:23.255 --> 00:38:27.055
that's going to work 24 7 for you, right? Um, but

976
00:38:27.215 --> 00:38:28.615
The UI piece of it too, right?

977
00:38:29.755 --> 00:38:31.405
Yeah, yeah. That, that piece too.

978
00:38:31.545 --> 00:38:34.325
Um, so we've even been playing around with that stuff too.

979
00:38:34.465 --> 00:38:38.165
Uh, so we can, uh, we, we have our own in-house, um, robot

980
00:38:38.165 --> 00:38:39.805
that we can either feed it, uh,

981
00:38:39.885 --> 00:38:41.965
a basic paint Microsoft paint image

982
00:38:41.965 --> 00:38:43.485
and say, Hey, I wanna make this ui

983
00:38:43.625 --> 00:38:46.485
and it just gives us back the JavaScript, the markup,

984
00:38:46.485 --> 00:38:47.805
the CSS everything to make it,

985
00:38:47.805 --> 00:38:49.245
or the c if you're gonna do something

986
00:38:49.245 --> 00:38:50.365
on, on that side of the house.

987
00:38:50.945 --> 00:38:53.805
Um, and, but it's, it's, it's really, yeah,

988
00:38:53.805 --> 00:38:55.045
both the front and the back end.

989
00:38:55.155 --> 00:38:58.405
It's, it's there and you, you really just kind of, you're,

990
00:38:58.405 --> 00:38:59.925
you're not a professional company, right?

991
00:38:59.925 --> 00:39:01.845
You're, you're, you're a single person that's trying

992
00:39:01.845 --> 00:39:03.645
to maximize your, your profit

993
00:39:04.105 --> 00:39:05.605
for the attack that you're trying to do.

994
00:39:05.625 --> 00:39:08.445
And the best way to maximize it is to limit the people

995
00:39:08.445 --> 00:39:11.085
that you need, not only for profit margin,

996
00:39:11.265 --> 00:39:12.685
but for also security, right?

997
00:39:12.685 --> 00:39:13.805
The less people that know about it,

998
00:39:13.805 --> 00:39:15.125
the less people you have to worry about,

999
00:39:15.965 --> 00:39:16.965
Right? And,

1000
00:39:16.965 --> 00:39:20.875
and AI as, as a coding assistant is cheap.

1001
00:39:21.425 --> 00:39:24.195
Yeah. Much, much less than another person,

1002
00:39:24.905 --> 00:39:25.905
Much cheaper. And,

1003
00:39:25.905 --> 00:39:28.195
and, uh, it's also more appealing on the

1004
00:39:28.195 --> 00:39:29.395
candidate aspect, right?

1005
00:39:29.575 --> 00:39:33.795
If I'm somebody who is going to cheat on an exam,

1006
00:39:35.075 --> 00:39:39.435
I would much rather prefer using a AI based solution

1007
00:39:39.455 --> 00:39:42.235
as opposed to turning over my whole entire computer

1008
00:39:42.535 --> 00:39:44.475
to an actual, another human being, right?

1009
00:39:44.475 --> 00:39:46.235
Because you don't know what they're gonna be doing,

1010
00:39:46.415 --> 00:39:48.355
you already know that they're most,

1011
00:39:48.355 --> 00:39:50.595
they're already not on the up and up, right?

1012
00:39:50.615 --> 00:39:52.315
You already know, you already know that there's some kind

1013
00:39:52.315 --> 00:39:54.115
of level of trust that you should be worried about to begin

1014
00:39:54.115 --> 00:39:58.645
with, but it's much more, uh, it's much more, uh,

1015
00:39:58.645 --> 00:40:00.325
reasonable from a candidate perspective.

1016
00:40:00.355 --> 00:40:02.845
Just run a tiny application, you can kick off at the end

1017
00:40:02.845 --> 00:40:05.205
of the day or even run on just the junk pc,

1018
00:40:05.205 --> 00:40:08.165
rather than letting somebody into your whole world knowing a

1019
00:40:08.325 --> 00:40:09.445
lot more things about you than

1020
00:40:09.445 --> 00:40:10.565
you otherwise wouldn't have to.

1021
00:40:10.665 --> 00:40:12.845
So I think, I think on both ends of the spectrum,

1022
00:40:13.345 --> 00:40:14.765
AI is also contributing there.

1023
00:40:15.785 --> 00:40:17.195
Okay, we had a great question.

1024
00:40:17.455 --> 00:40:18.795
Uh, just come in

1025
00:40:18.895 --> 00:40:22.155
and, uh, it's something that, uh, another thing that,

1026
00:40:22.155 --> 00:40:23.875
that you've been playing around with, um,

1027
00:40:24.095 --> 00:40:27.155
the question is about, uh, fakes.

1028
00:40:27.535 --> 00:40:29.795
Can a lockdown browser prevent someone

1029
00:40:30.825 --> 00:40:32.115
from using a deep fake

1030
00:40:32.375 --> 00:40:35.315
to impersonate the legitimate test taker

1031
00:40:35.935 --> 00:40:38.635
and allow that person to take a test for someone else?

1032
00:40:39.855 --> 00:40:41.995
Man, so I like how

1033
00:40:41.995 --> 00:40:43.875
that question's like asked in an absolute right.

1034
00:40:44.215 --> 00:40:46.515
Um, so I'll never say anything is a

1035
00:40:46.515 --> 00:40:47.555
hundred percent blockable.

1036
00:40:47.755 --> 00:40:49.275
'cause if you poke at something long enough,

1037
00:40:49.275 --> 00:40:50.635
you're gonna come up with a different way.

1038
00:40:50.695 --> 00:40:52.435
But with that being said, yes,

1039
00:40:52.435 --> 00:40:54.035
there are ways you can do that, right?

1040
00:40:54.035 --> 00:40:55.595
And so if you break down that type

1041
00:40:55.595 --> 00:40:56.835
of attack, what are you looking at?

1042
00:40:57.065 --> 00:40:59.275
Well, you're, you're looking at possible voice emulation

1043
00:40:59.535 --> 00:41:01.635
and you're looking at a possible, uh,

1044
00:41:02.035 --> 00:41:03.235
deepfake emulation, right?

1045
00:41:03.235 --> 00:41:04.555
There's two pieces of that, whether

1046
00:41:04.555 --> 00:41:05.635
or not you have to speak or not.

1047
00:41:05.775 --> 00:41:08.395
So it's really interesting what you can do there.

1048
00:41:08.535 --> 00:41:12.155
Um, the, the, the easiest route to go is to just kind

1049
00:41:12.155 --> 00:41:14.195
of prerecord yourself and have,

1050
00:41:14.215 --> 00:41:16.195
and just have a video of you not cheating,

1051
00:41:16.195 --> 00:41:17.715
taking a test for whatever, right?

1052
00:41:17.855 --> 00:41:19.635
So if I was gonna do something like that, I would do that,

1053
00:41:19.855 --> 00:41:22.555
and then I would get a, um, something like,

1054
00:41:22.675 --> 00:41:23.755
like many cam, right?

1055
00:41:23.755 --> 00:41:25.595
Something that has a hockey that allows you

1056
00:41:25.595 --> 00:41:27.035
to switch back and forth between cameras.

1057
00:41:27.135 --> 00:41:29.115
And so you just run your static video feed,

1058
00:41:29.255 --> 00:41:30.875
and if your proctor ever pops in

1059
00:41:30.875 --> 00:41:32.275
and asks a question, you just kind

1060
00:41:32.275 --> 00:41:33.810
of hotkey over to your live feed, right?

1061
00:41:33.810 --> 00:41:35.090
You just make sure you're wearing the same shirt

1062
00:41:35.090 --> 00:41:36.205
and sitting in the same position.

1063
00:41:36.385 --> 00:41:37.885
You go back and forth. The next thing you know,

1064
00:41:37.885 --> 00:41:39.525
you're using the phone, you don't even know you're doing

1065
00:41:39.525 --> 00:41:41.245
that, that that's like the, the low,

1066
00:41:41.245 --> 00:41:42.445
the low tech way to do something.

1067
00:41:42.505 --> 00:41:45.285
Now, getting into the user's question, um, yeah,

1068
00:41:45.305 --> 00:41:48.205
so the things you wanna look out there for is, is it,

1069
00:41:48.425 --> 00:41:51.565
is it a physical device connected to the system

1070
00:41:51.985 --> 00:41:54.285
or is it a software based device, right?

1071
00:41:54.545 --> 00:41:55.565
You, you probably don't want

1072
00:41:55.565 --> 00:41:57.365
to be allowing software based microphones

1073
00:41:57.365 --> 00:41:58.645
and cameras and those type of things.

1074
00:41:58.825 --> 00:42:00.405
Um, uh, so, but,

1075
00:42:00.425 --> 00:42:02.605
but again, you can, you can probably get back into that

1076
00:42:02.605 --> 00:42:03.645
with the process handling

1077
00:42:03.645 --> 00:42:04.765
and a whole bunch of stuff that,

1078
00:42:04.875 --> 00:42:06.285
that we don't have time to get into.

1079
00:42:06.425 --> 00:42:09.605
But, um, there, there are, there are ways you can look out

1080
00:42:09.665 --> 00:42:11.405
and, and block for those type of things.

1081
00:42:11.505 --> 00:42:13.165
But again, at the end of the day,

1082
00:42:13.475 --> 00:42:14.805
it's all about staying vigilant

1083
00:42:14.805 --> 00:42:16.765
and on top of what the latest approaches are.

1084
00:42:16.765 --> 00:42:19.125
Because if you block, if you shut one door,

1085
00:42:19.125 --> 00:42:20.285
another one's gonna open.

1086
00:42:20.965 --> 00:42:23.305
Right? Alright, great.

1087
00:42:23.605 --> 00:42:26.145
Uh, no more open questions.

1088
00:42:26.405 --> 00:42:29.065
Uh, and we're at, uh, 1 43 Eastern.

1089
00:42:29.685 --> 00:42:31.945
Uh, let's go ahead and, uh, wrap up.

1090
00:42:32.405 --> 00:42:35.425
Um, again, this was our last webinar for, uh,

1091
00:42:35.885 --> 00:42:38.505
Summer Demo Days 2024.

1092
00:42:39.085 --> 00:42:42.265
Um, if you would like to see, uh, recordings

1093
00:42:42.265 --> 00:42:45.065
of our other demos, our other webinars,

1094
00:42:45.065 --> 00:42:47.105
those are at tesus.com/webinars.

1095
00:42:47.525 --> 00:42:49.745
Uh, and please again, uh, take a minute

1096
00:42:49.765 --> 00:42:51.105
to fill out the survey.

1097
00:42:51.485 --> 00:42:53.425
Uh, it's a very, uh, short one

1098
00:42:53.485 --> 00:42:55.385
and we would greatly appreciate it.

1099
00:42:55.565 --> 00:42:57.785
Thanks everyone. Have a great rest of your day.