 As I said in my biography this talk is dedicated to two heroes that we've lost recently, Ronald Reagan and macho man Randy Savage. I'd like to add a special note also for Bubba who recently died of police academy fame. Good guy. So I didn't have time to Photoshop him in. Also I've never seen him in a cowboy hat but what I'd like everyone in the audience to do to demonstrate your love of these great American icons is I'm gonna shout America and I want you all to shout fuck yeah. So America. Nicely done. Okay. Get this going. Yeah. So welcome to the art of trolling. I submitted this talk actually as a joke I did not expect it to be accepted. I've submitted it. Yeah. So I like many of you have probably submitted many great talks to Defcon that have been technical and brilliant and insidious in many natures and they get turned down every time. The one time I submitted a talk that's you know kind of stupid it gets accepted so it goes to show. Okay. Can you still hear me? I've got one of these. That's probably what the feedback is. So okay. Raise your hand if you can't hear me. Okay. So I'm Matt Joyce. I'm also known as open fly. I am someone who's actually trolled people before sadly and this next slide is important. So trolling is innately going to piss some people off. Hopefully none of you are going to get pissed off at me and for the duration of the talk try to suspend your hatred and whether or not what I'm talking about is ethical or not. It's irrelevant. It's more about the technology the mythology and the wolves which is important. So we're gonna move on. The troll. We need to agree on a definition of what a troll is. A lot of different definitions of troll have been bandied about across the years and with things like lull sack and so on and anonymous running around a lot of different people are trying to fuck with what the word troll means and it's become oh my god I'm gonna go protest people killing the whales that's a troll it's not. So we're gonna go with a couple of these really bad definitions are kind of great. The one that really is the best is the one at the very bottom on the cyber bullying laws definition. I love that it makes the assumption that everyone is genuinely helpful that gets trolled and they're emotionally distraught as a result of it. So I actually kind of like that definition. I troll them. But here's my definition. I came up with this and I think it's pretty much one of the better troll definitions out there. It does involve a 30 year old single scotch. If you don't drink you should start. If it's against your religion or morality you know you can't be a troll. Sorry. Sun zoo coat quotes. I'd like to see more of them in conferences because I know pisses off attrition.org. So if you do submit or present here Sun Zoo quotes throughout all of it. Don't even have to actually be quotes just tag them. Okay so before we get into like modern day trolling let's go back in time to the prehistory. When the world was young and people were discovering that trolls not only carried big things and hungering into bridges they also you know pissed people off. So God is not a troll. In Judeo-Christianity God a lot of people were telling me this guy's a troll. He's not. This is proof. This is Beppel. A bunch of kids made a joke about one of his his prophets and he summoned bears. That's not funny. That's just dick. But God had a son. Jesus is a troll. He walked around in the Middle East preaching everyone being friends with each other. The last guy to do that was George W. Bush. Oh Loki kind of a bad ass. But a lot of people don't know that his best friend was a long wolf which was kind of important. And of course you know Loki needs no introduction everyone knows him. But Prometheus a lot of people don't know the full story about how much of a troll this guy was. He was fucking dedicated. So everyone knows about him stealing fire. But does anyone know like the real story behind why he stole the fire? It all started as a practical joke. Homeslice was like okay Zeus is out of banquet with all the other gods and a couple titans they're hanging out. They're going to decide what Zeus is going to get as an offering from the people of earth. So Prometheus being the asshole that he is basically dresses up bones inside of like pig fat and makes it look really good. Then he dresses up meat inside of like the bowels of swine. You know if you're Scottish it might appeal to you but Zeus was obviously not happy. So Zeus picks the bones. He ends up with bones being dedicated to him by the people of earth. And being the asshole that Zeus is he goes okay well if I can't get my meat no one else can either and steals fire from people. Prometheus not about to let his joke die steals fire back to people being the biggest asshole in I guess whatever Greek mythology that's a good one. So for that for his crime he ended up being chained to a rock and had you know eagles ripping out his flesh and then growing back every day which severe dedication good guy. Then there's the coyote. The coyote is probably the most positive figure of a troll in the history of Native American lore. He teaches many good and wonderful lessons and he's kind of great. A lot of people think another good one would be like the African guy Anansi. Anansi was not that cool. Anansi basically stole everything good he ever did from other animals. All of his stories he basically jacked. Thus patron saint of 419 scammers. Okay this guy is a modern day icon. So Stabby here was inadvertently part of a troll. We picked him up as an orphan robot at Resister. Some guy walks in and says hey does anyone want a robot arm and you know you never say no to that ever. So anyways Stabby's hanging out with us. We're going to the tech crunch hack day where there's a whole bunch of web entrepreneurs doing their hackathons doing their startup businesses including the AOL team which by the way failed it hard. We brought in a giant pneumatic arm connected to a blade and we hooked it up with Twilio set it up so that people could contact the stabbing arm via the phone choose the mode of stabbing and then we had a little stabber ID connected to it to fire it up. We thought this was hilarious. It turns out so did everyone else at the tech crunch and we ended up like coming in like 14th place of three but we were still invited to the the row of like winners of like the three people who won and they made us an honorary runner up just so that they could get us into the row of people that were actually presenting real business models at tech crunch. So people would be coming down the aisle and going yeah yeah yeah oh what's this? It stabs people. You guys are trying to sell this. So now we're going to get back to classical frolling. A lot of people may know some of this stuff. The big ones are logical fallacies. These are how you talk to someone and you know piss someone off through conversation. This is the one most people encounter. It's also the one that most people are unprepared to deal with because our American educational system has glossed over the fact that our brains basically have fundamental flaws in them. It's really easy to make someone say something stupid or believe something utterly insane. So I've basically taken the highlights comic books here and reworded them to to illustrate. So appeal to authority is a great one. I personally like to choose an authority no one else recognizes which I've kind of illustrated in the top one where some guys taking advice from his dad who's pouring orange juice on the markets of the Orient. Obviously he does not have a monocle or a top hat so he knows nothing of the markets of the Orient. But you know he's an authority figure. We move on over here. We got the appeal to probability. What are the odds? And this one is actually kind of useful especially when dealing with people in academia who rely upon probability. You know simplest answer is likely the most likely. Yeah. The best part about this is people have presumption of what the actual odds are. So sometimes you can actually convince something is untrue when it's actually true because the actual odds are not understood. Denying the antecedents kind of great just because this is wrong doesn't mean this is right. You know great ways of talking with people but note the top one that one's important. 9-11 trolling is some of the best out there. Now the great part is everyone's covered the obvious stuff now. It's you know these railies did it. The CIA did it. It's important to like take a positive spin on this and go at it from another angle and be like our heroic CIA agents were killed in a botched attempt to blow up the towers by terrorists who actually struck on the same day. Go for insane arcane and you can have a lot of fun with this one and no matter what you do you're gonna piss people off. Denying the antecedent here is crucial. So the argument from ignorance basically on this one evolution and creationism arguments are basically founded about them and those are also great. One reason it's great is because there's dinosaurs involved and everyone loves dinosaurs. So we got the raptor Jesus people running around on top of triceratops. It's pretty great. Arguments from ignorance are really easy to do and the problem with them is you can't use them on an audience like you guys. You guys actually have a fairly decent breadth of knowledge where you're gonna sit there and go this doesn't work but if you're ever like at Bible study and you want to fuck with people this works. So this is Adolf and Hans discussing correlative fallacies. While I was doing these I got progressively worse and at some point they switched over from being Connor and Mark to Adolf and Hans. So correlative fallacies are the best on earth. In fact, correlative fallacies are so badass that doctoral thesis people will actually get into real serious pissing matches over whether or not their correlative analysis is actually correct and you can take this to every level. So you can argue over like percentage error in a test three layers below someone else's test. You can this is basically how the people argue about whether or not the world is global warming or global cooling. You can argue any which way and just prove any argument using correlative fallacies and correlative analysis. But you can also do horrible things with them as shown in the top one. Okay, hold on. I will read it aloud for you because somebody asked. So the little boy says, I wonder why the black guy always dies first in these films? To his, you know, darker skinned friend. Well, it's obvious the reason black dudes always die first in horror movies is because they're genetically inferior to us Aryan folk. I don't actually believe that. In fact, my identical twin brother is African American. Thank God he's not here right now. So historian fallacies are the also great because you can go with some really arcane ridiculously wonderful shit with these. So I've done a couple of good ones here. They're good. I like personally prefer the ones to the right where the kids insinuating, you know, they're only 300 of us, you say, but you know, I ask you what Leonidas could do with 300. Choosing people out of history and taking them into the wrong era is wonderful because people are taught growing up that these are these are important stories that give us a message of hope and prosperity and so on. But obviously, many of them are, you know, they're not the norm. These are exceptional people and exceptional times and exceptional circumstances, which makes them great. The false dilemma. Okay, the false dilemma is a really good one. This one actually works on a lot of people and it works in two ways. One, it can easily get them turned around. And the other one is it can infuriate them to the point that they lose coherence in their brain. They just go it's like idiot mode for fury. And you all know what idiot mode is, right? You start talking with large technical terms and everyone just eyes glaze over believe everything you say. I'm sure most of the infosec people in here know all about that. They're entire business models based on it. Yeah, I said it. Okay. So we'll move on from there. The young Republican with the if by whiskey, I just love the name the if by whiskey. It's kind of a way to compliment someone while calling them an asshole. And, you know, it's the ultimate high form of policy. It's, yes, I agree with you. It's wonderful that you that you support stopping the slaughter of whales. But you know, whales are godless killing machines. Something's out of fact. Maybe a little bit better. I came with that that up the top of the head. Moving on behavior modification. So I did a little bit of research on this because behavior modification is one of those things a lot of research has been done on. A lot of it was done in the 50s. And it was done by people who are attempting to stop communists, gays, fascists. Anyone you could think of. Obviously didn't work. So this is the important part for you guys, your infosec professionals, you have to stop viewing people as people. View them as software. A lot of the same things are true. You just look at them as a black box design. And you're basically fuzzing the ever loving crap out of the person until you see a response that looks anomalous. Then you pick at it like a scab. Most of this is basically how most trolling works on any basis. It's look, find, exploit. So this this little bastard right here was the first bot I ever wrote. I was on IRC a lot in college. And I needed to go to class. Yes. Yeah, only college. So it goes back that far. But I was an IRC a lot in college. A lot. And I need to go to class. So what I did was is I automated myself on IRC so I can continue to call people names and harass people while I wasn't there. This bot basically just sat on there, responded to certain people and if it hurt its name would make certain responses that I would usually make. It would occasionally say things that I would usually say. And no one caught on to it for something like three or four weeks. And the only reason they did catch it because it was responding just a little too quickly. So this is a great hilarious but B also made me feel like I'm a vapid tool. So actual modification of human behavior involves changing people's surroundings. So these are the Martin and Parr seven characteristics I pulled off Wikipedia. And they are actual behavior modification guidelines if you will. So what I've done with these is I've modified them to meet my needs. I've called them the seven characteristics of behavior modification. For the most part, they're important. But one of them relies a lot on accountability and responsibility and being ethical. This one doesn't. Exactly the opposite. Zero accountability is absolutely vital. The fact that I'm talking to you is only happening because I don't do as much horrible crap as I used to do. One of the guys in the front row here actually chased me down a hallway the first time I met him when he found out that I was the guy from IRC. So this, you got to be careful doing this, you know, lots of proxies lol sec the shit out of yourself. But my second version of the bot kind of made fun of that. It basically worked off of IRC logs. And it generated a whole bunch of separate bots that would live off of an IRC log. It would see a new character enter, enter into a channel based off of that character's enter time and repeat the text that it said at that time. And there was multiple different ways you could use this. The primary one is you could take a very busy channel, record the traffic and replay it into a channel that you didn't like and flood the hell out of it. And no one would realize it was being flooded because they'd see different people having real conversations not realizing they're all bots. So when I was demoing this for the people at noise bridge, I pre demoed it on a German IRC server using a an IRC log based off of the hackers movie script. So it rejoined all the characters in time with the movie and had them talk to each other as such. It was interesting. I have two versions of that. The one on my website is actually for using what's that stupid site called? Free note is it? No, not free note. Tor, that's the one. Yeah, sorry about that. The reason all the Tor nodes don't work on things like IRC or forums is people like me. It was too easy. We used them all. Then we went back to proxies, which are a bitch to find. Unless of course you're one of those horrible people who you know, steals them. So this isn't a very important piece of technology right here, 3d scanning. And with the help of the maker bot team at Maker Faire this year, I helped them get 3d scans of the moon. My moon. That's my mass. It's on Thingiverse. It's open source. There's a lot of different technology and trolling and you can use all of it. I assure you. So this one's kind of my my favorite and most famous. I got bored one day and embedded an mp3 player inside of my hand grenade. So this ended up on a whole bunch of blogs. Fine, a couple even hit boing boing and hackaday, which is great. But a couple months later, the TSA found it on my Flickr feed and blogged about it. Not once but twice. Basically, my mp3 player personally is never allowed on an airplane. The really great part here and I'll leave it to all of you guys to you know, bitch to the TSA about it is none of them actually provide the attribution and this is a creative commons image. So have some fun with that. Okay, so this one's another good one. How many people here are familiar with schmoo con? Yeah, it's really hard to get tickets. Luckily, one year, a friend of mine was there and contacted us the Friday of schmoo con starting, I was about to grab a bus down from New York. And he goes, you're never going to believe this shit. These guys have actually made their badges out of plastic. And I'm like, okay, get a dollar bill, send us a picture on your cell phone. He does. We marked up a whole bunch of fake badges and laser cut all of them. This one was massively scaled in bubblegum pink. We had another one that was normally scaled bubblegum pink but with a unicorn on it. We also made five black badges because that was one of the most common types of plastic we had. And we made five of them I didn't realize that black was actually being used when we got there we realized holy crap. Now he's black being used. It's the organizer badge. So as far as I know, only one person managed to get into the conference with one of the black badges because I only gave one out before I found out that that wasn't allowed. But somebody did get in with the giant bubblegum pink badge which was confiscated and then sold to charity. But yeah, interestingly enough, this is water cut. You could probably plasma cut some derivative or just use cardboard and color right and you could probably screw up their game because note how this has numbers and some sort of game involved with it. So did theirs. We changed the barcode to basically say fuck you. People were scanning the barcode seeing fuck you and going what how does this work into the game? They thought that our badges are like some sort of secret game. This one I have to note because DNA is prolific in the world of trolling. And I'm sure there's there's members out here I would like to say that time fag is a douche. And I'd like to know when that day I was going back with Naruto again. But so troll forage was something that they set up initially was private and then they went public and then what private again and then what public again and then somebody stole the tar ball and now it's on an EU and I don't know why. But troll forage was hilarious because they created their own version of trolling software and I suggest looking at this because it'll give you a great insight into how trolls go about bypassing filters. This is actual like infosec research. These guys will actually go after failures in things like capture systems and this right here is basically four or five years old but demonstrates the degree of complexity that was involved in bypassing and fucking with people on forums. Highly capable people doing utterly worthless crap and then you wonder this is how Lulsec comes around. When someone gets very bored. Yes if you all want to know Lulsec is actually ran by a name a guy named villain. V-A-V-I-L-L-A-N. You can find him on pound lush on Ryzen. A lot of people don't know that it's true. This one is my favorite I never did this but whoever the hell did this gets a hell of a lot of points. This is a 4chan troll. Basically someone called up and convinced Oprah Winfrey that there were over 9,000 penises out there raping children and she went on the air thinking that there was a real organization out there that had over 9,000 penises all raping children. It said it in that exact way. I really have no other way to explain that that's just it's astounding. Okay ethics this is kind of important it's hard to get into um so when you first start out this is like hacking it's like playing you can play with your friends that's okay you can play with people that you don't know in environments where you expect people to play with you that's okay like if you're on IRC there's a certain expectation that you're going to be fucked with when you're on the defcon network there's a certain expectation you're going to be fucked with when you're in a Walmart gets a little gray when you're at your cousin's wedding there are certain things you just don't do um you can apply that or you could be more moral about it but the end result is is how you choose to go about playing with things like this is moderately important but the most important rule out there has nothing to do with ethics it has to do with being funny if you're going to be a dick you better be funny otherwise you're going to end up you know getting stabbed in the face or something it happens it'll probably happen tonight uh no he's not actually he's in new york um okay you know what i'll tell you a quick story about mr stabby because i got some time so mr stabby we we pick him up we're working on him we originally set him up as just trying to figure out his wiring and fixing pneumatics on him and we're setting up a uh basically a pinata party with the robotic arm this is actually where he got his name we got very drunk and the pneumatic arm wasn't doing a very good job of smashing the hell out of the pinata so repeatedly whoever met him was inevrated and ran up to him and goes i've got an idea while many of you think brie has great ideas some of his ideas are less than great this one was uh let me hand the robot a knife so he didn't like duct tape it in there he just little two pincer arms he tries to attach like a butcher's knife to it we're sitting there going he's going to kill somebody so i'm walking up to his like dude doesn't your lease have the three laws of robotics in it turns out his lease does have three laws of robotics in it not only that he didn't put him in uh but mr stabby at that party apparently someone got enamored with him and we woke up the next morning and found out that he had been profiled in the columbia newspaper like columbia university's new paid newspaper someone had done a very serious background check on where the robot came from where he was manufactured contact with the manufacturers tried to figure out where it was sent who it did work for and they got as far as the university that it was sold to in the 70s and then nothing no one knows where where it spent 20 years and suddenly ended up on it for those that didn't hear the argument is jail entirely possible um so that's that's the origin of stabby okay so what do we learn this part trolls are heavy contributors to cultural values and that's true for every hacker out there there is a troll in fact the original hacking began with defacements for the most part well not the original but the stuff that we did the stuff that people of my age group grew up in we had defacers like well-sec everywhere we all knew them we we had hackwizer global hell all these funny people in fact let me tell you a quick story because i really don't have as many slides left as i thought so this is a this is a good one in college we set up a honeypot it was my alpha we set it up as a shell server and handed over to the hackwizer internal IRC server and said this is a compromised machine please use it through one of their members and then we had tty snoop set up and we watched what everyone was doing on the machine and pulled their exploits one guy hopped on with three gigs of binaries and it attempted to execute every last one of them in row x86 binaries we watched this guy for two hours attempt to run every single binary he had on an alpha so this is the level of competency you see in people who are script kitties but the level of hilarity that comes out of them is also fairly great lol sec basically took sequel i and turned it into an art form they're all going to jail eventually but they were hilarious and that's important art art evokes behavior evokes emotion the modern behavior modification techniques is kind of true where we haven't seen the full impact of that yet you haven't seen trolls get fully involved with google plus or with facebook there are a couple folks out there one of my friends tom ryan gave a blackhawk talk last year about tracking people with insidious intent on the internet using a fake woman named robin sage who by the way is my girlfriend he fucked her so the reality is is instead of creating one person on there i could quickly modify one of my scripts to create a thousand people on google plus i have a script i didn't finish in time for this event but is mostly done and what it does is it generates fake graphs easy to do in gnu plot and thanks to the guys who broke into uh mit install those doctoral journals you can now associate any one of those graphs with a doctoral journal just say this graph is from there and most people will believe you in fact this this has worked in academia it's a good art it's the problem that you're going to run into with behavior modification is people are innately trusting of certain areas people are innately expecting things to be right in certain regions they're just like machines you throw them a curveball at the right time and they're going to fail so defining standards in the practical application of cutting edge technology it's kind of true troll forge and other people basically standardized the way in which you interact with bypass and capture systems so that their scripts would work between different forum units and so on and so so on and so forth it's uh it's pretty vital to technology that people continue to play with stuff it's pretty vital that they take their playing to the next level and build from there so these are references I added pretty straightforward the troll forge one is on there behavior modification is on there uh music piracy links are to the grenade and a couple of other scripts I added and I'll add more as the week goes by but at this point I'd like to ask anyone for questions magnets actually there is a guy in the audience right now that has a great response to that my friend aesthetics over there from noise bridge had a phenomenal troll the noise bridge crew got together and went to a a clown posse concert and they offered to do a science fair to insane clown polytechnic right so they're trying to teach them how magnets work how rainbows work scientists juggalos just not just not the clowns that you you showed me you know those girls were oh god I assure you they're oh we got another question yes and my name is actually registered to it if you want my home address I am a pirate okay don't tell any of the people I work for that I am though just between us how do I answer that a big part of what we do is manifest destiny you what shipping supplies plenty of shipping supplies is anyone getting this joke oh oh yeah this is a good one by the way convert all of your your measurements for data to match to imperial I've been using hog heads of bites recently on the internet just to talk with people and they actually believe it's real works okay any more questions ah so this is important I wasn't lying about that this guy villain we've known him for a little while he's kind of shady we thought he was in New Yorker for a while he really wasn't turns out he was a fed and this is all second hand but uh villain was basically running around on the internet being being a baller you know hanging out with the women you know booze and schmooze and sending us lots of updates about his life and we realized that he was very quiet whenever lol sec was doing anything big and he would drop off of IRC and he started targeting people that we knew like 2600 Nets IRC service and they got hit by a whole bunch of lol sec people and we were like okay we've got to know this guy he knows all the same places we do and we talked to each other we all confirmed that we were all not involved except for villain no one could figure out villains actual contact info so I highly recommend if there are any federal agents in the audience you hunt this villain down villain is uh he's large and blonde very blonde okay any more questions you okay anyone else no one really oh I got one I can't make out what you're saying shout it you know what this is an important lesson if you can't hear someone just respond with something that sounds like what you thought yes absolutely holy from my heart deeply and morally I believe everything that you just said I would kill to defend those ideals okay anyone else okay actually this is a good argument if you ever want to deal with a fucking European one they know jack shit about our geography they give us shit for not knowing their geography most of them know don't know anything about ours they think that fucking you know Idaho is next to New Jersey they also the metric system is retarded for reals if anyone's ever actually thought about this for more than five seconds they figure it out yes you can divide by 10 it's decimal yeah whoo you can't fucking have it quarter and third it like you can a 12 a 12 or a base 16 system and base 16 goes into binary it's a two end and it's a perfect square fuck metro you no it's conspiracy it never happened if I had to choose a running mate Christopher Walken that man would kill for me I'm sure okay not only did we land on the moon we killed God when we got up there I stole that from the onion but my god that's a wonderful piece of literature I highly recommend reading it okay anyone else you ah so glorious agents of our Central Intelligence Politburo charged valiantly into the buildings intent on destroying the edifice to capitalism that was ruining our nation however unbeknownst to them radical Islamists like this guy right here look at that fucking beard basically destroyed the building they had no idea there was actually going to be a terrorist attack that was actually successful what were the fucking odds yeah I'm sorry I can only speak the truth crap flooding there's actually this bot that actually goes on IRC I don't know if any of you have actually met it but it basically talks about shitting that's that's the actual crap flooding bot that's all it does yeah maybe I was promised cake too all I got was a beer it's pretty good though thank you okay I've got 10 minutes more questions shoot babies okay about what oh yeah um trolls are highly important to uh reproduction if there are any ladies out there I highly recommend okay I'm gonna call this talk because people are walking away