Welcome everybody to master class this Thursday, November
16th, 2023.
We have some great presentations that will be having this
evening, both Umm narrated and live.
So let's get going on the fun.
Umm.
And our presenters, we get back to those and see who's first
Justin Hunt.
Are you ready?
Hey, Professor Fairy, sorry to bother.
I messaged Justin.
I sent you an IM about this too.
Sorry I asked if it would be OK if I moved up first.
There's some stuff going on this evening and I was wondering if
it was OK if I could move up my slide.
I'm sorry.
Yeah, sure.
That's fine.
Absolutely.
You wanna go first, OK.
OK.
Yeah, that'd be fine if if that's OK.
Justin, are you still OK with that?
Not a problem, yeah.
Yeah, that's fine.
OK.
Thank you.
I'm sorry.
Right, no problem.
No, no worries.
Go right ahead.
OK.
Can everybody see that?
Yes.
Perfect.
Alright, thank you.
Good evening everyone.
My name is Rick Pascal.
I am presenting the security breaches in healthcare, a huge
topic that's been going on over the last few years, especially
during the pandemic.
I know there were a lot of issues since then and some
glaring issues and vulnerabilities and some data
leaks through the healthcare system and also through third
party providers.
Uh for medical insurance and things of that nature, so it's
more of a.
Structural issue and infrastructure and what we are
focusing on there.
So I wanted to cover the overview of it and kind of some
impacts and kind of some focuses that they are going through.
Overall, the healthcare industry has been suffering some of the
highest volumes of cyber attacks and anticipating probably more
to even come since even more so than the financial industry
combined.
The trend overall with a lot of breach damage costs surpassing
several other industries, and there's a horrible warning
coming through a cyberattack storm approaching the the
segment of healthcare data recent.
Recently, the breaches continue to rise.
Vulnerabilities enhanced are due to any implementation of new
technology that were due to COVID uh businesses or new
practices as well, with rapid adoption rates.
Additionally, there are impacts from the medical data theft from
patient risk and additional medical data theft, and then
medical plan and plan providers are at major risks.
The healthcare sector itself suffered close to about 295
breaches in the first half of this year alone.
Uh, that's according to the the Office for Civil Rights, or OCR
for aid, reported breach portal that's been created and also far
more than 39 million of individuals have been implicated
within healthcare data breaches within the first six months.
Data breaches this year are through, like, as I said, June
and the biggest breaches have stemmed from several cyber
security vulnerabilities, whether it's been third party
software being used, infrastructure is not in place.
Your traditional social engineering that may have come
from, and there's been between either healthcare data or
hospitals themselves attacking for patient industries as it
moves forward.
The breach itself has a upward trend.
It's been continuing to change over the the last 14 years.
Umm, it's a a with the adoption of new rapid information
technology, especially since COVID it's helped with some sort
of.
Sorry, I lost my train of thought.
My apologies.
It's been drenched with the industries in particular and
attractive data breach targets, so healthcare itself is a huge
data breach.
So huge target for them.
Umm.
Healthcare records have names, social securities, data, birth
date of births, payment information, insurance
identification numbers.
Uh.
And protected health information.
Health guarantees himself hold a large amount of both personal
healthcare information and personally identifying
information.
So with data breach prevention being such a concern, why hasn't
that looked into too much?
More umm, there's been some counterbalances from the breach
to data that has kind of created a preparedness for institutions
now or hospitals.
Uh, as notification requirements are now being implemented as
regulations of data breaches are occurring.
Uh, and the data breach response plan is ultimately a a way for
entities to avoid fines and and at any type of customer loss.
Uh, 2021.
From breach data itself from prior reports, actually was one
of the highest data breaches since the Office for Civil
Rights was publishing and receiving reports of these
trends from 2009 to 2022, there were over 5150 data breaches
reported between those years.
There were still 882 of those still in investigation as of
2022 that did not have any type of HIPAA enforcement actions at
that point.
Whether it came from ransomware or again social engineering,
some form that came through with data breaches itself.
The highest reported breach overall.
Stated that the health records and the electronic health
information where the primary targets of it, mostly as I
mentioned prior to regarding names, Social Security numbers,
dates of birth and other information for insurance claims
and cause or causes.
Hacking or IT incidents associated with unauthorized
access.
Disclosure incidents, ransomware, vendor attacks, or
direct assaults on these networks are how the the bad
actors were able to try and and implement these attacks overall.
Here we have a a graph through the the trends in the healthcare
records and every breach reported is containing 500 or
more records total that have been exposed.
And as you can see, year over year from 2009 to 2023 during
the kind of start of the pandemic and leading into this
year, there has been a steady climb.
It's been a lot of issues as it comes through the issues
reported itself, focus on closed cases that are of course still
being investigated by HIPAA and the OCR, which again that is the
the Office for Civil Rights.
The one of the the biggest itself from.
This was that the the breaches themselves have exposed a
disclosure basically of 382 million, 262,000 and 109 total
healthcare records.
It's that equates to almost more than 1.2 times the US
population.
Uh, which is a huge issue.
Uh, in 2018 alone there were breaches of 500 or more records
that were being reported at around almost one rate, or one
per day.
So that itself leading through 2022 is almost an average of
1.94 healthcare data breaches of 500 more records reported every
day.
It's kind of eye opening when they they move into to this
segment.
Umm, there was a decrease that people thought that there were
beginning to see.
As you can see that the drop from 2021 to 22 and now 23 as
you could see they they believed that you know the
infrastructures were being reinforced by healthcare
providers and through the healthcare industry.
But it appears that bad actors had reinforced their efforts
more so than what they were seeing in the financial industry
due to the highly profitable data that, Umm, healthcare plans
and health care providers uh provide, unfortunately.
Umm, a few others for Healthcare Records expose, you know, year
over year.
As we mentioned before, upward trends and exposure 2015 was
actually outside of the pandemic.
Had one of the largest.
Data breaches years that have three major plans involving
Anthem, Premera Blue Cross, and Excellus.
As you can see in one of the graphs here, Anthem had a total
of over almost 79 million individuals affected with their
breach.
Primera had 11 million from and all both from hacking or IT
incidents for the breach that occurred.
And then a recently as the most recent one that was one of the
larger ones was the American Medical Collection agency in
2019.
Again, another hacking incident.
As you can see, there are a few other issues that came from
mostly with ransomware attacks that had occurred between
institutions or from healthcare providers, or overall with the
science applications of International Corporation.
Overall, just a loss.
It was a total data loss where files everything else just gone.
It was a crazy uh catastrophe that just kind of came through
so, but the incidents themselves, other than the
hacking and ransomware employee errors, were another major issue
that it came from improper medical record viewing,
negligence on filings and data theft all came from it as well
from internal issues.
Uh, HIPAA and security awareness training has now been
implemented a lot by these institutions as a way to try and
combat these issues that are continuously growing UM to
monitor access or to try and aim and reduce any level of the the
breaches that continue to grow uh as well.
And as you can see on the other side, it's as well from the
breaches for the reporting entities, you can see the total
number is it just climbs steadily year over year, which
is kind of a a scary trend.
But with COVID as it, things changed.
As we all know it, healthcare changed.
Finances changed.
Education change.
There was a lot that went through and one of the
coinciding factors that led to a lot of these breaches.
Were mostly due to the brief adjustments that what it
appeared to within the infrastructures, whether it was
remote, home, functionings, vendor level, access issues that
may have come through and just everything during the chaos of
the pandemic, bad actors were ultimately able to take
advantage of that and almost farm from an industry that does
not put or apparently does not put a lot of asset allocation
into data security, which is is rather unfortunate.
This year alone, just a couple of reported breaches, as I
mentioned towards the beginning, the managed care of North
America had almost 8.9 million individuals impacted due to a
malicious code that was found within their network.
Umm, it was a a very unfortunate event which managed code the
manage care of North America itself.
Mostly founded unauthorized party had accessed several
portions of their systems and removed complete copies of
personal information as it went through.
Umm, the care managed care of North America contains benefits.
Information from Medicaid all the way to dental records and
everything else across several states.
Uh.
Information that was lost was similar to everything else.
Socials dates of birth names, addresses, Medicare information,
government issued ID numbers.
It was a major disaster that came through that these bad
actors were able to to gather for America was a it's a long
term pharmacy network, had a disclosed breach earlier this
year of almost 6 million individuals.
Uh, they are actually a fortune 1000 company as well, based out
of Kentucky.
Uh, they discovered a lot of suspicious activity earlier this
year, around March.
Uh and later then also determined that additionally an
unknown party had accessed those systems.
Again, very similar to the managed care of North America,
the information that was lost was rather unfortunate to some
of those were even from deceased carriers that we're trying to be
utilized unfortunately.
So it's complete.
Freezes and notices had to be worked on with HIPAA and with a
lot of security firms and institutions like Experian,
Equifax, things of that nature, and one of the most recent
largest ones up here, actually within my region, Harvard
Pilgrim, which is a large healthcare provider up here in
the New England area that I'm aware of.
My wife, unfortunately, actually was one of these impacted
individuals.
That also, unfortunately, now involves our children, from how
that actually works.
The Harvard Pilgrim itself had a ransomware attack that took all
systems offline and personal information of current and
former subscribers.
Independence were involved in this ransomware attack, so
gathering all these individuals over 2 1/2 million had personal
information that was gathered and collected.
Since then, Harvard Pilgrim has openly made continuous efforts.
They've actually been being very great on communication, which it
appears some of these have not because it's he reports have
been six months to a year after investigations have completed,
whereas Harvard Pilgrim has been very upfront notifying their
users and open to the public about enhancement of security
systems during the aftermath of the event.
UM, enhancing any type of user access protocols?
Vulnerability scanning that they're continuously going
through from any endpoint detection and response solutions
that may be going through and even more administrative work
through you know, password resets and trainings as well.
As I alluded to earlier, the pandemic was was one of the
largest purposes or proponents I would say in the umm, the the
attacks themselves, COVID-19 generated several new challenges
and opportunities for companies operating in the US and the the
healthcare industry.
Health providers were struggling to provide care for.
Uh, their patients, due to the pandemic.
Even non COVID-19 patients, they were having issues with it and
they needed immediate attention.
So there was a a challenge that was going through there.
And to overcome those restrictions, healthcare
providers were hastily trying to implement new hybrid or remote
work environments.
Whether it was, you know, office staff to get out of the way, to
make room for COVID issues at a hospital, and having you now
work from home because the the close proximity to one another,
healthcare, healthcare providers themselves, having you focus
more on telemedicine for heavier utilization with infrastructures
and networks that were not super secure, which was very
unfortunate.
So it was a big shift and a big change, but the one of the
larger pieces was during that time a new implementation of
electronic healthcare records or their systems going a lot of
companies or organizations were going from paper to digital and
in doing so, the telehealth platform Mike Mixed with that
and any other remote tools for those collaboration purposes of
1 on one visits or check-ins or things of that nature.
Umm.
Ultimately opened up several new pathways for cybersecurity
attacks against those companies against those healthcare plan
providers against any type of protected health information.
With the premature adoption of these, umm, the success rate of
it and the I guess failure rate, it was unable to properly
protect the security and the data itself to mix with the
privacy of the medical records due to unexpected attack vectors
and the US healthcare industry actually saw a 25% rise in
successful cybersecurity attacks during the pandemic.
So that was just at the very beginning as we saw in the
graphs earlier, continuing to climb, which was rather
unfortunate.
Risks of basically one of the risks of advancing health tech.
So the pandemic did push a lot of things forward, relay making
companies realize that they needed to adapt and they needed
to reinforce data security and reinforce a lot of
infrastructures for them to within their IT departments as
well to grow and to to move into the next phase, whether it was
in the financial institution, education or even in the
healthcare industry, because a lot of this health tech was
moving into different routes such as advancements towards
drone delivered medical supplies.
As we all know, we have, you know you have Samsung watches or
Apple watches or some sort of data risk bands that are
collecting your activity or medical information.
And they've even started to develop pocket ultrasound
devices that have been forcing patients.
Umm and other healthcare providers to start embracing a
lot of these new solutions in the medical field.
But it's also leading to that data to be transferred between
third party utilization and home utilization between the hospital
environments as unsecure points of entry or points of access as
it goes through.
Technology has itself has additionally created a a
reluctance in the medical system in the medical field on both
patient and doctors to adopt A lot of new methods due to
concern risks associated with digital care.
I myself would never use telemed.
Telehealth, I should say I know a lot of people have.
It is very useful to to per se in that.
But with telehealth, there's a lot of data being transitioned
between it, because apparently while the the provider is having
this conversation, they have access to, you know, their
medical records while they're having this conversation and
what's not to say that the network is in, you know, not
secure from the person's home itself as an access point.
Point it could be from the institution for they're going to
gather this information because a lot of the health data that's
going through there, even if it's collecting data from
healthcare, watches or anything else, those things track
anywhere from, you know, diseases, their fitness, sleep,
mental health diets, you know, any type of medical treatments
that maybe go on even all the way to to fertility.
So a lot of changes that are going on.
Uh, but with the advancements, they're still data breaches that
continue to have issues and it leads to more concerns about
these changings.
And if you know, rushing into these new segments and new areas
are before being properly secured against cyberattacks
such as third party vendor tools or telemedicine without properly
allocating this asset or the resources to support these
changes in the meantime.
So it was one of those that during the pandemic they were
doing everything they can and now it's almost like they're
trying to throw a band aid on it.
And implement these changes.
As I mentioned before, going through healthcare apps or what
they changed healthcare apps themselves have been connected
devices.
They're advised by the FTC for obligation to secure and control
the data collected.
The FTC does regulate a lot of the data that is collected by
those and making certain that they are secure.
But with that data being shared amongst medical providers, then
exposes any risk associated with it as well.
Umm, some of the the big issues that come through it outside of
the the data tracking is that is a concern.
Individuals wanna be treated by a person rather than some sort
of AI which a lot of people do through, you know, phone
medicals or phone urgent cares.
Uh.
Before leading anything else today, or even telemed like they
wanna physically, uh, they want to physically be in front of
someone on the issue as well with data tracking and
technology within health care as well.
Is that the software in the hospitals can tend to be faulty,
causing delays in treatment or even misapplying treatment, as
there have been instances where.
There was a software failure that had a incident was in 2013
where a patient was actually given 38 times the dose of the
regular medication due to faulty information within the
electronic healthcare records.
It never updated that continuously.
They had been given the doses or the doses were changed or
anything else.
So I know since thing things have changed, but there's still
unfortunately has not apparently been a fail.
Safe to see a lot of these issues.
Uh.
Within data privacy or even healthcare record updates.
Additionally, a lot of people are concerned with these changes
with that are financial incentives for these
institutions to start using new products and new digitization of
records and not saying keeping things in the Stone Age.
But they need to be able to reinforce these losses and these
updates.
And these these reports that are they're going through.
So the the biggest question is why is healthcare continuously
being attacked?
Why is it more so than you know the financial field financial
technically is still one of the highest attacked fields with
cyber security incidents outside of that.
Healthcare is just behind it as I am a very close #2, moving a
little bit further breaches within healthcare vary from
credential stealing malware to insider errors or even hardware
lost.
Overall, personal healthcare information is a highly valuable
asset on the black market.
Sorry, that should say black market, not black market.
My apologies.
Uh.
More more than credit card credentials or even personal
identifiable information because it leads to a greater incentive
for cyber cyber criminals to sell health information is more
valuable as a criminal can continue to use that information
for fraud in other targeting the victim or scams that could take
it use of any type of medical condition.
Create false settlements or insurance claims and lead to
purchase or possibly been resale of medical equipment that
they've claimed to be used as the individual.
Overall, the profit per record stolen for personal health
information is $355 per individual.
So think about that on when one report filed to the OCR of a
report of 500 or more records being compromised, one of those
records is worth $355.00, so it could potentially be worth
$355.00.
So it's extremely profitable for cyber criminals and that's one
of the reasons that they're focusing on this because of the
lack of infrastructure and the lack of security that has been
implemented into this due to the pandemic and adoption of new
technology as well. Without protection.
Uh, the protection itself.
You know, what do we have overall?
The FTC has a health breach notification now.
Overall, the the FTC Act was implemented because of course,
you know, we care about our privacy and the security of our
health related information.
Uh, with the FTC.
That means that any breach notification rule makes certain
that if an entity has been breached, the company itself
must take specific steps within that breach and either
notification and communication of that to the individuals that
were breached and or as regulations or penalties go.
Face that.
So it is a big piece to where if any time there's an outreach, it
must be reported in rolled out for what the next steps are on
the plans too.
Of course, we know we have HIPAA, which is overall the
health insurance portability and Accountability Act that
maintains any sensitive health information that has been
compromised.
And they're ensuring that medical data has been ensured.
So they're working with the FTC on this as well, making certain
that vendors with pertaining health records or health related
entities must notify US consumers.
Of course, the FTC the hip is requiring this and in some cases
even media.
If there's been a breach that is large enough that it must be
known, otherwise face civil penalties or violations towards
it.
Uh.
Additionally, there are uh forms of state regulations that have
been coming through for protect data protection rights.
On the medical side of things, the US Department of Health and
the information or the Department of Health and Human
Services, they don't mandate what electronic platforms are
being utilized, but they are encouraging heavily on utilizing
the NIST guidance documents for when choosing a secure provider.
There's a lot of policies and regulations that go through it
in leading to failure to comply with HIPPA regulations.
Uh for a breach?
The annual limit or penalty is around almost $2,000,000 per
tier and about $50,000 per individual as a penalty towards
that as well.
And that's implemented by the state.
Uh overall, one of the biggest issues is a or a protection, I
should say, not an issue with a protection is the new IT
infrastructure.
As I mentioned that the FTC is working on the breaches we've
been seeing, the slight decreases in healthcare attacks
itself.
So infrastructures are starting to be pushed further.
Cyber security is becoming an at a huge investment in healthcare
it it does tend to lag behind other industries as only
healthcare spends about 6 to 10% of its overall IT budget on
cybersecurity.
Uh, since COVID and all these breaches that have been going
on, uh and projected increase in spending towards cyber security
has been almost increased to 51% amongst the industry.
The data breaches themselves are have been reduced when
organizations have been implementing tools in teams
dedicated to protecting and responding to any data breaches
or suspension of unauthorized access, and the healthcare
industry itself has reported to a cost savings of almost
$2,000,000 per incident since going through that and actually
utilizing some other instances within teams and some small
forms of artificial intelligence to help mitigate any of these
issues.
So overall in summary, my apologies, I may win on a little
bit longer, but in summary, protecting patients, sensitive
data or complying with regulations has been preventing
unauthorized access and ensuring patient safety, ultimately
preventing data breaches or supporting research and
maintaining trust within healthcare sectors as healthcare
data security is extremely important and to safeguard
sensitive data effectively, it's extremely vital for healthcare
organizations now to invest in a more robust security measure,
employee training and technological solutions as my
references and questions.
Sorry.
Thank you.
That was intense.
That is a lot of information. Wow.
Yeah, that was a great presentation, too.
Good job.
Yeah.
Awesome, very cool.
Thank you.
Yeah, it's, it's it.
Something I am passionate about, whether especially my wife in
the medical field, I mean she she deals with a lot of it and
just it's insane to hear some of the stuff with how some people
access particular things unfortunately.
Yet.
But it was it was very eye opening during the research.
Well, it's pretty sad too, because we consider our stuff,
especially with HIPAA, we consider our stuff when we go to
the hospital and or, you know, the doctors and stuff.
We consider that to be.
Umm.
Protected.
Classified.
That's in that.
Yeah, and that's that's our assumption that it should be
that case, but unfortunately it it continues to go and it seems
to be that hospitals are actually getting better with it
and now it's more towards in line with the healthcare
carriers themselves.
So you're blue.
Cross is your your Blue Cross is your united.
Healthcare is things of that nature.
Pharmaceutical companies that maintain these records, and it's
Umm.
just a vicious cycle, unfortunately, and hopefully now
they're starting to get the picture.
But the pandemic changed a lot of it, and it was just easy
pickings, unfortunately.
Right.
Yeah, yeah.
Yeah.
And yes, Charles II do I do agree, I do think that a lot of
it probably was from medical systems using outdated
technology.
As I mentioned, Alec resource allocation was not where it
should have been, especially moving hastily into a digital
age for medicine.
And it just left a lot on the table that needed to be
corrected or scooped up.
Yeah.
Thanks.
I have my yeah.
Sorry, sorry if I went a little over, but I appreciate it.
Thank you.
Thank you so much.
That was wonderful.
Great job.
OK, umm, next we have Jason, Are you ready?
Alrighty.
On next I was doing yes, uh, alright, good, good good.
Doing good.
So let me see.
I'm gonna tell something real quick.
You guys let me know what you see on your screen.
Is is that OK?
OK.
Alrighty, the one moment.
To quickly set this up.
OK.
One moment here.
So do you guys see my presentation or do you guys see
like a whole UI around it?
What do you guys see?
We see Alexa, what are your virtual?
What are virtual assistants?
That's it.
To the Internet?
Well, the the image that you made for the slide.
OK, good.
Alright, so welcome everyone.
Welcome to my master class presentation.
I hope you guys are doing well today.
I will be discussing what are virtual assistants going through
a brief history of the technology, its features and
capabilities will also touch base on and influence that
virtual systems has on modern day culture, media and
entertainment, and washing.
That's home when we closing off the presentation, but before
that, we'll discuss the future.
What does the future hold for VA's as a whole?
So to start off, what is the history for virtual assistant?
So brief history as we were, if you were.
So when I in the 1960s, it all started back with the
introduction of first interactive voice response
systems.
So as you guys can see here by this image very very old school,
very basic, very classic.
There's not really much going on.
It's very typewriter asked right when you look at this type of
technology at 1st and the input devices you can see here is a
little telephone little pick up telephone and people would use
this telephone to input voice commands that way.
So very basic idea of for the technology.
So we transition into 1996, where Clippy was then
introduced.
This is where voice assistants gained again a huge bump in
popularity in this world.
Microsoft wanted to give their first take and their first
iteration of the technology.
Excuse me.
So would Clippy.
Clippy was basically an animated paper clip for Microsoft.
This was pretty much like a little fun animated assistant of
yours that would help you execute certain commands on your
Windows machine.
Now one one thing I do wanna point out through these virtual
assistants is the fact that over time they begin to have their
own brand or identity.
So we started off with something that was very basic and very
blended.
1st 2 something that had a name, something I had a brand to it.
Something that had a logo to it and the image.
Excuse me and going forward with Alexa or Google Assistant and
and Siri, Apple Siri, you see that trend going forward that
these systems begin to have a brand and a particular identity.
So now that this this leads us to to 2011 and present day where
we have our our well known systems like Apple Series 2011,
Amazon Alexa and Google Assistant.
This for me can be seen as like a huge turning point for this
technology as a whole.
Once Siri, first introduced in 2011 and going forward, and who
knows, I mean what other virtual assistant will be direct
competition with these big three giants?
But we'll have to wait and see what happens going forward.
So next we'll touch base on the features and capabilities.
So these are the four main ones that I got out of during my
research.
We have voice interaction, task automation, information
retrieval and personalizes assistance using AI, so in voice
interaction.
Of course, this this is the the main way that you interact with
virtual assistants.
Everything is done through your voice and through your voice.
Only there's no hand on interaction.
There's no haptic interaction.
There's no on screen or touchscreen interaction.
Everything is done to your voice, so this also allows like
like I stated for hands free communication and making that a
reality just by using your voice feature slash capability
capability #2 is task automation we have task been automated from
reminders to making phone calls mount, managing calendars and
make an online purchases.
Some of these features are features that not a lot of
people tend to use, for example, online online purchases can be
considered a risky feature because you don't want to
accidentally activate Siri and then tell.
Tell Siri.
Ohh yeah, I wanna buy a $1000 smartphone or something or
something like something that wasn't like for vote or planned
right.
I feel like with a feature like that, being able to make online
purchases, they can't bring a little bit of risk down the
line, but yeah, those are just some of the features that that
are included in the test automation side of things.
Next is A is a very common feature with these technologies
as information retrieval with the use of online databases.
Virtual systems can give it instant access to information,
such as weather updates and news, and also conduct search
queries and figure out certain facts about animals or
celebrities finding out their age.
Even with athletes, you can even ask Siri what what a particular
team that does absolute play for, and you'll be able to get
that information, and in an instant, while we're virtual
assistance.
And then the last feature I have listed here is personalized
assistance with the use of AI.
Now I feel like AI and virtual assistance kind of go hand in
hand.
They're kind of like siblings in a way.
These technologies, if you mention one, the other will will
also be mentioned no matter what, because they they
correlate with one another one another.
So through AI based algorithms, virtual assistance can learn the
preferences and habits of users to tailor recommendations and
responses accordingly.
Now a perfect example that I can think of.
This includes Siri with Siri suggestions.
Now I just activated Siri by saying the name, but now we're
serious.
Suggestions.
You can pretty much have apps suggestions or task suggestions
listed for you.
So once you swipe down on iOS and you bring up your spot, your
spotlight search, you notice that Siri will give you
suggestions for any particular app that you would want to open,
or any task that you would wanna do, like texting somebody or
making a phone call.
That is pretty much the personalized assistance Siri
learns from your from your daily use, your user habits, and will
give you app suggestions and test suggestions that are based
on what what you're doing on your daily basis.
When it comes to using your iPhone, so these are four of the
main features and capabilities that I've covered through my
research and through my time with my master class.
Now next this is the big the Big Age old debate, right when you
debate any piece of technology, you debate which one is the
best, which one has has it all, which one could?
Definitely be considered the goats of of that particular
technology.
So these are the four that I from was able to gather for this
slide, but these are the the most common ones though that I
was able to gather warning them that I don't really see in a lot
of conversations or I'm really like when it comes to just use
is Bigsby.
So Samsung Bixby, out of all 40s?
That feel like Bigsby is not really mention a lot.
You guys can correct me on that if you want to do, but Bigsby if
I had to rank these, Bixby would obviously be 4 because I don't
really see Bigsby a lot compared to these other big three, but
yeah, so Siri is exclusive to Apple.
And their ecosystem of devices and services, as you guys may
know, Apple has this very big niche of exclusivity and keeping
their technologies and services tailored and and optimized just
for their just for their pieces of hardware and just for their
pieces of software.
So you can only really access Siri through Apple Devices and
Apple Technologies.
You can't really access your nowhere else, unless somebody
out there is good at jailbreaking and they somehow
get serial on Android, right?
There's multiple capabilities within technology with the
night, so you just never know, but usually serious locked
through Apple services and Apple products only once again, you
guys can debate me on that and correct me know if you can.
That's completely fine.
I'm open to conversation, but also series still has a long way
to go when it comes to overall functionality and intelligence.
There's still a lot of areas that these operating systems
commonly where they like where they like capabilities and where
they like overall functionality and just intelligence, but
there's still room for improvement.
And I feel like serious is one of those virtual assistants that
can definitely be improved more.
I mean just recently with the release of iOS 17.
Yeah, they've changed a lot with Siri, you're able to just
activate Siri just by saying Siri.
You don't have to have that initial verbage with hay in the
beginning of that phrase.
You just have to say to her her name or or his if you have it as
a male, you're just gonna say the name of the virtual
assistant and then and then she'll be able to conduct tasks
and do commands.
And also you can do back to back queries and commands.
So before, once you, once you act your your virtual assistance
here to do something, she'll automatically, you know,
disappear or or deactivate after one particular command.
Now within iOS 17 you can do I think up to like 3 or 4 back to
back.
So you can say something like Siri.
Look this up for me, and then Siri.
Look, this other fact for me right after that, and even after
that, you can make a phone call.
So it's just more flexibility and functionality now, but I
always 17 when it comes to Syria and like I said, there's still
room for improvement.
And I feel like on Syria doesn't has room for approval when it
comes to just overall features and capabilities.
Now, with Google Assistant for all my Android peeps like Google
Assistant is available with all or compatible with all Android
devices and it's available to download online OS.
So unlike the vendor log style of Siri, where you could only
really access Siri on Apple products, Ohm Google Assistant
is now its own thing.
It it's now its own app.
Google Assistant was just originally part of Google search
feature, but now it sends it it's integrated as its own app.
You could download Google Assistant from the App Store and
use it as you will.
If you prefer a Google Assistant over Siri or or Android over
iOS, which is always a great thing, having that our
accessibility and compatibility right.
So like I said, Bigsby out of these four is definitely at
least common one, or at least for me, so Bixby shares all the
common features with other virtual assistants, such as
making phone calls and launching apps.
The typical stuff that you would do with a virtual assistant,
some features that sets the assistant apart though include
toggling auto rotate on and off, taking selfies, and replying to
emails within Gmail.
So those are just a couple of features that you could use to
distinguish Bigsby from everybody else.
And then of course, last Bologna.
Last but not least is Amazon Alexa, and this is obviously a
common one with within everybody, even if you're not
that tech savvy, somebody's gonna have an Amazon Alexa
somewhere somewhere within their home.
So with Alexa, one of the biggest features that I found
very interesting while conducting my research is this
feature called Alexa Guard.
Now, this pretty much acts like a like a security intrusion
system.
This allows users to monitor suspicious activity such as
broken glass or alarm triggers, and they could be triggered or
activated by using the simple commands such as Alexa.
I'm heading to work, so a feature that I really found
really interesting.
It's pretty much your own security system within the
virtual system, so it's pretty awesome.
And then just this last point here, like I said on at the
beginning of the slide, these are considered the big four on
air quotes when it comes to virtual assistance, each set
with their own capabilities and imperfections.
Like I said, all these VA and technologies have room for
improvement, so they're definitely not perfect when it
comes to overall functionality as a whole.
So determining which one is the best?
Really just depends on your personal preference, what you
prefer and what ecosystem are you under.
So if you're under major ecosystem well, but of Android
devices, or if you're under a iOS ecosystem where it's all
just Apple products, that's a big determining factor.
That'll that'll determine if you wanna use one over the other, so
I just have a little video here.
It's it's a 11 minute video, but I'm not gonna show you the full
thing.
It's by fellow YouTuber Marcus Brownlee MKBHD.
Yeah, I don't know if you guys are familiar with him.
It makes a lot of tech videos and he made this one recently
this year, pretty much detailing this entire debate.
So the virtual assistant debate and which one is really
considered the best?
I'm gonna go to show like 2 to 3 minutes of it of him just
comparing like basic simple questions and functionality and
functionality between the four VS.
Can you watch her? Actually.
Ohh God can later.
Yes.
OK, good.
Thank you.
Alright, so at the end there it's a very valid point that
when it comes to search queries, you oftentimes find that Siri
heavily relies on Wikipedia, where other virtual assistants
like Google Assistant kind of gives you like that direct
answer, not direct result.
So that's kind of just a minor comparison between the four and
like I said, the four giants, if you will, when it comes to VBA,
alright.
So next, what is the future for virtual assistance?
Three major keys and three major aspects that I gathered here for
this slide.
The first one they here is having more virtual assistant
employees.
Now I know this sounds crazy on paper because people fear that
15 to 20 to 30 years on the line.
Umm.
Human employees will eventually get replaced by all these in
technologies and all these integrations and and people have
talked about having humanoid androids and pretty much all
this stuff that you see in like, like movies, all this stuff that
we see through movies and all, all the stuff that we seen
through our media, people fear that that's going to happen now.
It's not a fear that you should really hold on to and be like,
Oh my gosh, this is the end of the world.
It's more just like, let's welcome this in.
Let let let.
Let's welcome this new movement and in and see what happens.
Let's see how it can impact our society, or the way that we do
things within work as a whole.
So with virtual assistance due to the events within Tech has
made it possible for people to work remotely for people to work
remotely, which has made it possible for people to work
remotely.
Sorry, they can even provide more complex services such as
social media management, content creation and customer service.
So like I said, better than holding on to this and having
having this be for fear.
This is more like let's see how this can benefit us as a
society, and let's see how this can kind of be like a welcoming
change.
At least that's how I see.
I don't know if that's just just shows my love for technology,
but I don't really have that fear that a lot of people have
nowadays that we're all going going to be replaced by
technology, especially within the workforce.
But change or aspect #2 is having virtual assistant
advancements does equal higher demand.
Now all these advancements equal higher demand.
There's more businesses and individuals rely on virtual
assistants to handle administrative tasks that demand
for virtual assistant employees will increase, which can also
lead to more to more job opportunities and higher
salaries.
Now, who doesn't want to have more job opportunities and
potentially a higher salary?
I mean right, we are an internship group.
We're all part of a company having more opportunities and
having higher paid salaries does doesn't matter.
At least it's not in in the illegal fashion right.
But if if it's involved in tech, that's the best thing possible.
So just having those opportunities within a workplace
like ourselves, like PGIP tech is gonna be a great thing going
going forward and going online for years to come.
Now my love, my last kiosk worked here is virtual and
augmented reality will become more widespread, so the
technology is like mixed reality.
Virtual reality and augmented reality will become more
popular, more widespread, helping users to feel more
connected to the world colleagues.
Examples of this would be Metaverse and Apple Vision Pro.
Excuse me.
Sorry and Apple Vision Pro now say what you wanna say about
metal or Mark Zuckerberg.
Love him or hate him, no matter verse is, it is an interesting
concept.
It is something that that is intriguing.
Being able to just be in your own personal virtual realm and
being able to work and make profit and make money through
this virtual space.
Now obviously the one thing that people are scared of is escaping
the real world, like escaping being able to interact with real
people and real life.
I was keeping being able to collect the nature.
Just escaping your actual physical world as a whole is
always a thought in mind when you think of technologies like
the metaphors or like virtual.
Yeah.
And interpret stream correct like virtual or augmented
reality.
That's one of the biggest things that people always have in mind
is will, will I not be in tuned with the real world after I put
this headset on and and spend hours to what dwelling in my in
my virtual space. Right.
So but yet again, again, we can't just think about the
negatives.
We we have to take positives out of this and say maybe this will
bring benefit, maybe this will be helpful for people who can't
really commute to work every single day or people that just
like Kyle said, people who are introverted and they don't like
people.
So they rather just be in their own virtual space, right?
So we we always gotta take out the positives and not just stay,
not just let the negatives.
All these technologies overshadowed, if that makes
sense.
So yeah, that's what the futures look like for these
technologies.
And having virtual and augmented reality integrated into it is
always a great thing.
And then I'm looking forward to see what happens with Metaverse
and Apples Vision Pro, which is their first time doing a virtual
or mixed reality headset.
First time Apple has ever done delve into this or or dive into
this type of market and well, I mean, we'll see what happens.
The headset supposed to come out by 2024.
If any of you guys are familiar with that, let me know if any
thoughts or questions at the end of my presentation.
It's a very, very fun thing that we're having into when it comes
to these technologies as a whole.
So OK to close off, we have a fun little uh slide here and
that is the influence of virtual assistance within modern day
culture and modern day media and entertainment.
Now we have Jarvis.
Now, if any of you are.
Comic book fans or Marvel fans, you guys are gonna be familiar
with, obviously Tony Stark and Iron Man, but most importantly
is Jarvis.
Now, this is Tony Stark's AI virtual assistant companion.
Key automates all of today's task and I can relay information
even while Tony Stark and Ironman is in combat.
So whether that be vitals, heart rates, oxygen, Jarvis obviously
gives all that information to our men and to Tony Stark, he
also really suits as an Internet of Things device because Tony
doesn't really have to have a suit ohn to to really
communicate with Jarvis.
If you guys seen all the MCU movies or know from the comics
ohh Jarvis can be anywhere within Stark Industries Tower,
Tony can be elsewhere and you can still find a way to
communicate with George.
But with Tony, no matter what, a suit doesn't have to be on for
him to really communicate with his virtual AI companion.
And most importantly, here Jarvis has personality.
I mean, he's literally British, right?
He has a British accent.
He doesn't come off as robotic as most virtual assistants that
we know in real life today.
So that's just our best for you guys.
I have a little clip here.
I'm just some Iron Man scenes with Tony Stark and Darvis.
I won't.
I'm only gonna be showing like 2 minutes of this, and that's how
we're gonna be closing off.
You guys can hear though, right? Convert.
Thank you.
Our thanks.
Ohh I would so more but I wasn't giving permission to show until
I'm seeing a movie, but I hopefully you guys enjoy it and
that'll be.
I'll be it.
These are just my references.
If you guys want the video, the link to the video for Moore's
video, it's here I could find a way to post it on to the chat
and everything else.
Thank you everyone.
This is very nerve wracking for me coming out here and publicly
speaking and presenting this.
I was anticipating this for the entire month, so I'm glad I
finally got this out of the way and I was able to give a good
presentation.
If you guys have any questions or comments, let me know.
Thank you.
Fantastic.
Thank you.
For the entertainment.
Yes, no problem, no problem.
Thank you.
Now that was great.
Any questions or comments?
Great information.
I mean, not only that the entertainment from all of our
assistants going off while you kept saying their names.
Right.
The the that happen.
Ohh my gosh, I'm sorry.
It did.
I had both both the A1 and the G1 talking.
That's that's.
That's funny.
My my apple went off a couple of times.
That happened to me right?
Yeah.
It happened to me when I when I said Siri a couple of times as
I exactly at least they know their name.
well, but yeah.
Easily triggered, but umm.
No, that was excellent.
Thank you so much.
That was great.
Thank you guys for giving me the time.
Appreciate it.
Thank you.
Great job.
OK.
Next in line, if I can get to it.
Alyssa, Are you ready?
I am I alright?
Awesome.
Let me share my screen here.
I can get this.
OK. Ohh.
Can everybody see that?
Yes, but we see it not as a full presentation.
OK.
We see it in the SharePoint, I mean in the PowerPoint.
OK, let me start then.
Can you see that?
Yes.
Perfect.
Alright, so my topic is the history and some variants of
ransomware.
Alright.
So what is ransomware?
Ransomware is reference.
That's malware designed to access files on a user's
computer.
The program is used to encrypt files and demand a certain
payment to have the files decrypted using a decryption
key.
The method behind these attacks is to corner the user and to
giving the hacker meant money as it is easier to do than try to
fix the issues themselves.
It can have devastating effects on any company, especially
targeting medical facilities for their large databases of patient
information.
So it starts by, receives a spammed message, the attachment
is downloaded with the malware connecting the crypto ransomware
is downloaded to the computer.
Files are affected and then the ransomware message is displayed.
Thus, the victims must use a browser or use Bitcoin to pay
them back.
There are three phases, the infection, encrypting and
demanding phases.
I'll ransomware like umm like mentioned ransomware is a form
of malware to gain access into another user system, such as
through phishing emails and malicious download.
A link to unknown website or maybe through hacked program
like remote desktop protocol.
With this, the hacker has control of the users computer
and other devices that would give up their files with some
compensation.
They're encryption phase is normally through the creators
operating system by accessing the files, encrypting them
through a hacker encryption key, and then replacing the files
with encrypted versions are to do it man for the ransom, a
hacker will often change the background of a ransom note or a
place files with a ransom note demands it with some sort of an
instructions for them to exchange of cryptocurrency.
If paid, the hacker will often send a symmetric encryption key
to decrypt the users files.
And the history of ransomware A started in 1989 by Harvard
Harvard student named Joseph L Pop.
And it was called the 1989 AIDS Trojan, or mentioned by as a as
the PS.
Cyborg.
It was an attack on the World Health Organizations
International AIDS conference to infect 20,000 infected dissects
disc at.
I can never say that right.
The attack would encrypt a users name on files and hide
directories on their computers after 90 reboots, if a user were
to send $189.00 to the post office box in Panama City, FL to
the PC Cyber Corporation, they could gain access back.
They could gain access back.
Pop was eventually caught, however, was unfit to stand
trial for his actions, citing insanity and was never tried for
this kind of crime.
So now we're go into outbreaks.
The great boom of ransomware attacks came to start in 2017
with a with a wanna cry outbreak.
This outbreak created a large scale ransomware attacks on big
name companies.
These attempts were essentially to gain thousands of dollars by
hijacking various company devices.
COVID-19 was also another contributor to another surge
attacks, as most offices were forced to perform duties and
tasks online.
This surge of ransomware attacks spread through Microsoft Windows
on computers and servers due to lack of awareness and outdated
systems.
The hack was founded by the Shadow Brokers, also known as
Internal Blue, which exploited the vulnerability of Microsoft
Windows.
Data withheld in encrypted by users who whose computers were
affected by the what malware for a ransom.
The $300.00 was the demand in bitcoins and then later
increased to 600.
If users wish to gain back their data, the data the attack
affected around 230,000 computers, which with around $4
billion in loss from other countries and individuals around
the world.
There are different kinds of ransomware variants.
Maze is the first which encrypted files and performed
data theft at the same exact time.
This program collected sensitive data from users.
Computers encrypt it if the demands were not met.
The data was then exposed online to the highest bidder with more
than often the on the dark web.
This group was responsible.
Or the group responsible for maize had officially disbanded.
However, the grown, growing concern is how this variant is
worming its way into another ransomware lock.
Bit is the next one.
It was created in 2019 and was developed to take down large
organizations with powerful and cryption techniques quickly and
preventing any detection along the way.
Ryuk was another targeted variant and is delivered by
hacking a the remote desktop protocol or using spear phishing
emails.
Access to these programs allowed the ransomware to encrypt
specific types of files and demand encrypto currency for
data in return.
It is the most expensive variant of ransomware and asks well over
$1,000,000 for the decryption key.
That's why this type of focus focuses on large companies.
Dear Cry was designed from Microsoft Exchange
vulnerabilities in 2021.
This type of variant focuses on encrypting the specific types of
files and instructing users to send them an email to have their
files decrypted with a fee through though the amount of
varies with that.
So here's the evolution in trends started in 1989 with the
age Trojan, which spread via floppy disk or diskettes.
And use some symmetric cryptography with monitor boot
time count.
The second one was in 2004 with a GP code it spread through
phishing emails and used asymmetric cryptography with
encrypted my documents through Microsoft.
And as you can see, there is a lot of Microsoft ransomware
attacks in 2012, the Riverton spread through outdated plugins,
Crypto locker used or spread through again phishing emails.
Umm Spagett was also another one, but it also did.
It's harmed through email attachments.
Encoder was in 2015 and it spread through the back door, a
Magneto CMS.
Uh.
In 2016, another flaw was that was found in BitTorrent, which
bypassed the gatekeeper to infect the system.
Umm, the wanna cry?
Of course, we just talked about in 2017 the flaw was in the SBMM
server and use asymmetric cryptography and then in 2020,
again this has been updated as far as the newest one, but it
spread through the COVID-19.
Umm.
And use VP script for UAC bypassing.
So how do you protect yourself from where and where?
There are essentially 4 practices that can reduce well,
technically five.
They can greatly reduce the amount of detect attacks on a
system and our network.
The first is to have complete awareness of the situation.
There should be training for employees discussing the
repercussions of a mock situation compared to a real
one, since most ransomware is spread through phishing emails,
training employees is all to always check their email
addresses would greatly reduce the risks involved.
Another practice is to have continuous protected data
backups.
Having backups can help an organization recover their data
without giving into the hackers demands, and it's secured at
backup is something that cannot be overwritten or corrupted by
data.
The next best practice is called patching.
Patching is when there's a vulnerability and is a patch is
made to fix the issue.
Whether this is done by updating the system or the program, it
must be done with all the systems to prevent a hot a
hacker from gaining access.
The last practice is to utilize user authentication.
Strong strong authentication such as implementing biometrics
or two factor authentication can greatly reduce the chances of a
system being hacked and then finally ransom anti ransomware
solutions if malware does not end up compromising the system.
There are methods to help detect and act upon the threat.
They are automatic restoration, wide variant detection,
restoration mechanism and fast detection.
And then here is how we mitigate through an active ransomware
infection.
There are 6 steps.
Umm, the first is to quarantine the infected machine.
If there is a detection of on a specific machine the ransomware
was spread quickly.
Therefore, is essential to isolate the machine by disabling
the wireless Internet.
Pull out any wires connected to the device or shut down the
systems of around the affected machine to limit the infection.
The second step is to leave the computer on to keep volatile
memory safe as encryption of the files can make the computer or
system unstable if powered off.
The third is to have a backup.
As mentioned before, is important to have private and
essential files on a protected backup.
Dr #4 is to look for any solutions to do trick to decrypt
the files.
Investigation of a decryption software can help restore the
files without given into a the ransoms demand.
#5 is asking for an experts help.
Digital forensics investigators may have advice or ways to fix
the solution.
The this solution #6 is to wipe the machine and restore it from
a clean backup operating system to ensure that the malware is
deleted from the server.
And those are my references.
Great job.
That was great seeing all that.
Thank you guys.
That was super nervous.
Yeah.
Sure, but you did very well.
Thank you.
Yeah, it's always good to know about that stuff because you
wanna protect yourself, right.
See how it happens.
I I think we have one that was kind of skipped a few times.
Are you still here?
We didn't put you to sleep, did we?
See, I'm trying to get in there.
Where's my list, Justin?
Hello.
Was that you?
Yeah. Hello.
Yeah.
Aye.
Can you see my screen?
Yes.
So my topic is on VR in the workplace and I wanted to choose
this topic for my current occupation is with Walmart and
we we have, uh, some VR that we use for training.
I haven't had the chance to use it myself, but I've heard
stories of people who have used it and they always sound very
interesting.
So what is VR?
VR is a simulated 3D environment created with computer hardware
and software and with the use of a headset or goggles it gives
the users the ability to interact with the environment.
And that.
Thanks to uh popularity of remote work, some employers are
finding it a lot harder to find candidates with the soft skills
that they're looking for.
Umm, but uh VR has made it easier for people to learn and
actually retain the information that they need during their on
boarding process, which I have noticed a lot with a lot of the
new hires that we get.
It seems like the onboarding they just they're not
remembering as much.
Uh, like year after year?
I really think if we would use RVR more often it might help
because we do get a lot of younger people and sometimes
sitting in a room for just a couple of weeks just staring at
a computer screen.
You you start to get a little bored of it and being able to
interact with a VR headset I think would really help them a
lot.
There are several types of VR.
There's non immersive, semi immersive and fully immersive
and non immersive.
VR is just a 3D rendering on your screen, similar to video
games, and the users have limited control over the
environment with the use of keyboard and mouse.
A semi immersive environment is accessed by either the computer
screen or the headset and glasses.
You don't use your physical movement.
It's similar to fight flight simulators that the airlines and
military used to train their pilots.
And then we have the fully immersive, which incorporates
sound site and sometimes touch.
This is probably the one more people are familiar with, with
like the Oculus Rift and the Vive headsets, you would use a
headset, goggles, or a helmet and gloves or handheld devices.
But when most people think of of VR, they probably think of it as
a video game.
But it's it's more than a video game.
VR provides a lot of occupations such as firefighters, EMT's,
police officers, soldiers and surgeons with efficient and safe
ways to train.
Teachers can provide new ways of engaging with their students by
bringing 2D objects to life or being able to experience
experience.
Different parts of the world, from the classroom within retail
customers have the ability to try on clothes.
See how furniture would look in their home before buying it.
And there are many more applications, and VR has only
scratched the surface of it.
The uses in the workplace for VR come from employee training,
improving marketing, teamwork and collaboration.
Employees can use VR to safely be trained to perform tasks
without putting others in harm's way, and it can also be used by
employees working in different locations to collaborate on
projects.
This remote work is becoming more popular and everybody is
trying to get that job from home and VR can make it much easier
to connect with everybody in the company.
Improvements to VR has on retail seemed to be almost endless.
Several clothing stores offer VR fitting room as well as I
according my research they have.
It was like a virtual like fashion show.
So instead of actually being there in person, you could.
I think they have a like a camera setup and so you will see
from the perspective of that camera and the with the VR
feeding rooms he gives you to an idea of how certain clothing
looks on you as well as jewelry and even some of them will offer
style recommendations the try before you buy gives a lot of
customers a greater sense of involvement and interaction
which can make them more willing to buy the product in VR can
also be used in a remodeling process to get a good
understanding of how everything will look and help you make the
best decision.
But there are a lot of pros to VR.
I think that are a lot of cons as well.
So VR equipment can be kind of expensive, especially on the
startup because the make applications for VR can take up
to 8 weeks for a basic one and cost.
A minimum of about 15,000.
A more advanced application takes up to I think it was ten
weeks and could cost around 30,000.
And as we all know, anything technology related can be hacked
and VR headsets come equipped with cameras and microphones,
and depending on the companies, they might store the training
that they've used with their associates somewhere on a server
to be reviewed later.
So it could definitely has a way of getting into your company's
network.
But with the full immersion systems.
Uh people tend to experience nausea, disorientation, as well
as neck and shoulder strain.
And I can speak from experience on this one, wearing a headset
for, but like 30 minutes you can really start to feel it weighing
down on your neck.
And it really does cause some problems.
Umm there as well as the disorientation cause it if you
haven't ever played with a VR system, you don't you don't
understand how immersive it truly is.
And I have done some research and people were saying how
someone was able to hack into a VR headset and remove the
boundaries that it has put in place to keep you from running
into something in the real world.
And they removed them and people were crashing into walls or even
falling downstairs.
That's definitely a a concern when using these and
socializing.
When you get so used to using VR, even remote work, you kind
of forget to connect to actual people, and the more we use that
and I I feel like progress in the world, the more of a reality
that becomes, a lot of people are not socializing as much as
we used to and everything's becoming more online and like
online shopping.
People don't go into stores as often you you order stuff, you
have it sent straight to your house and you cut out the
middleman.
Really.
Which can be good, but also has a lot of negative effects as
well.
So even though VR has made great strides in how we can interact
with users and other employees, there are still a lot that can
be approved upon.
But I foresee it becoming a more commonly used product in a lot
of companies like they always say the only constant in this
world is changed.
So we either accept these changes or get stuck in the
past.
Any questions?
No, that was great.
Excuse me.
Excellent job.
Does anybody have any questions?
Yeah, definitely.
Amazing.
Good job.
Thank you.
OK so I have one that I need to do for.
A former.
Intern for his master class and I hadn't gotten to it yet.
If I can pull it up.
Ah OK, I may not pull it up because the volume is so low.
Let's see what we can do here.
Let me try and put it pretty easy to go.
OK.
Can everybody see the screen?
All right, let's try it.
I'm not too sure about the sound.
I might let not let it go too long, because if you can't hear
it, it's not going to help.
But we'll see what happens.
Hi everyone.
I'm Eric Joest, and today I'll be talking about the
implementation of steganography in the context of an Android app
that I wrote a while back.
So first, just a very short explanation of steganography and
I will try to keep this short because Shay is already given
such an excellent presentation explaining the concept a few
weeks ago that for my purposes here I'll just say secondary is
basically the practice of hiding one message inside of another
message or object, and it basically advantage it has over
cryptography as a means of hiding or obscuring a message is
that when done properly, the message or object containing the
message should be indistinguishable from a copy of
that same message or object which does not contain the
message.
So for the purposes of the app I made, which I'll be talking
about here, the hidden message will be a string and the
containing object will be a picture.
So our goal is to embed that message within the picture
without noticeably alternating the pictures, dimensions or
appearance.
So moving on to the actual app now, I called it Stead caption
which was short for steganographic.
Caption, which described as intended functionality of adding
a hidden caption to an image.
The app works by embedding a string text within a picture
without noticeably alternated.
The image can then be resent or shared with the message
embedded, and that message can be retrieved from the image with
the app.
The use case I imagine for this app when I wrote it was to share
secret messages through images that the user might be sharing
on social media or texting to another user of the app.
For an additional layer of security, the message is also
password protected using a simple exclusive war cypher that
I will discuss shortly.
This is an Android app that I wrote a while back and I haven't
really revisited it much and probably a year or so.
The origin of this app came from a Kotlin project I did on a site
called Jet Brains Academy, which is a subscription learning site
from Jetbrains who are the company behind the Intellij IDE.
Which Android studio is also based on, and they're the
developers of the Cotwall language itself, which Google
has designated as the preferred language for Android
development.
A few years ago, so I've been learning Kotlin, although I
still do practice writing Android apps and Java as well.
So the original project was a console app.
Britain and Gotland, meant to demonstrate the principles of
steganography and cryptography by embedding a text message
within a message within an image and protecting it with a
password.
After I had successfully solved this project, it occurred to me
they would make a much more useful Android app rather than
text based console act.
So I set out to bring it to Android and also extend the
functionality of that as well as to try to seamlessly integrate
it with social media or messaging usages.
And I tried to do that through various options.
I'll show you later.
Like copy paste functionality and mainly a share button
functionality that can integrate directly with other apps on your
Android device.
As I mentioned, this app was a work in progress.
When I moved on to other things, so there are a lot of fixes,
updates and improvements that I need to make that I notice that
going back through it and actually so many that I have A
to do list live later on.
We'll talk about a few of them.
Also, I'd like to mention the UI wasn't my main focus at the time
I was treating this more like a proof of concept demo for the
steganography library.
So you will notice the interface is not a finished level.
So now we'll talk about the high level view of how we go about
hiding a text message within an image, as well as encrypting
that message with a simple password implementation.
First, we will encrypt the message using something called
an exclusive or cipher, which is a simple cipher using the
exclusive war logic gate, and I'll talk about that on the next
slide.
So then after we have the encrypted version of our message
stream, we will need to store that as an array of bytes which
eats by capable of storing 1 character of the message.
We will then store those bytes 1 bit at a time within the RGB
color information of the pixels of the image, and we'll do that
by storing only one bit in what is known as the least
significant bit of the color by for each pixel, and that concept
of least significant bit.
I'll come back to you in a minute here.
Also, when we access the color information of each pixel, we
get an RGB value with all three components, the red, green and
the blue.
And we could take advantage of this to choose which color value
we're encoding our message on, and also therefore in code up to
three messages per image, one on each RGB component.
Now we'll get into a little more detail about how the exclusive
or cipher works, and then later I'll go through the actual code
a bit, let you see how to implement it.
You're probably familiar with logic statements like and and
or.
So just to review like an and logic gate would return true if
and only if both elements being evaluated were true and an oral
logic eight will return true if either relevant is true and
exclusive, or returns true if and only if one element is true
and the other element is false.
And the way that we can use this for a password is to breakdown
our two strings, the secret message text and the password
text into byte arrays, and then perform the exclusive war
evaluation on each corresponding bit which we use to build a
third string.
This third string, the result of the bit by bit exclusive war
operation, is our encrypted message and due to a property of
this exclusive or logic we we will be able to retrieve the
original message given the encoded message and the password
and that works according to these formulas.
Here the initial string exclusive or password equals
encoded string and then performing the same operation
with the encoded string and password encoded string
exclusive war password equals initial string again in a
minute.
I would going into to the code to show more detail on how this
is achieved.
So now for the actual steganography.
We'll be encoder encrypted message into the image as I
mentioned before, we will need to iterate over each pixel of
the image until we reach the end of the text message we are
embedding and for each pixel, retrieve the RGB value and then
retrieve the specific color value from that based on whether
we're trying to embed in the red, green, or blue.
We'll take that value, which is an integer ranging from zero to
255, and convert it to a binary string in order to manipulate
it.
And that is where the concept of the least significant bit comes
into play.
Once we have that binary string, we're using the common
representation here, which is called little endian form,
meaning our values are.
The lower value columns are on the right hand side, just like
in our normal base 10 decimal decimal number representation.
Therefore, we can see that the values of each column starting
from the right and going left are two to the zero power or the
ones column 2 to the first or the twos column, and so on
through 2 to the 7th power a column where a positive bit
would represent a value of 128.
The ones column on the other hand, can only influence the
overall number by one, and so storing our bit there will have
the least impact on our color value, which remember ranges
from zero to 255, and we're only possibly altering it by 1 and
that's why we call that the least significant bit and
another thing to note and why I say only possibly alternating
altering that overall number by one is that sometimes we'll find
the bit in that least significant bit position will be
the same value that we want to embed and so that will further
help decrease the impact we're having on the image visually.
Finally, once we've reached the end of our message, we want to
stop iterating over the pixels to be efficient and also leave a
flag to signal the end of our message, which we can look for
in the decoding process in order to also stop that once we've
reached the end of our message.
So now I think would be helpful to start going through some of
the code, so I've switched to that here and here.
We start with our encrypt function where we apply the
exclusive war side for and you'll notice that accepts the
message string and the password string.
Both already converted to byte arrays and it also returns a
byte array.
So after we set up some counters to keep track of which bit and
byte of the password we're on, as well as immutable list of
bytes which will hold our encrypted result and we
initialize a byte string that will be using to store each
individual byte.
To add to that list.
Then we loop through each bit and byte of the original message
with this nested loop and using exclusive or logic which returns
true if and only if one input is true and the other is false.
So in our case here, that'll mean if the inputs are
different, it'll return true.
So if the password bit is not equal to the current message
bit, we write a one, otherwise we write a zero.
Then we update our counters to see if we need to move the byte
counter of the password bit.
If we're at the end of a bite, we can add that to our list up
here of encrypted bytes, and then at the end we just return
that converted to a byte array.
And this leads us to our encoding function here, which is
where the logic actually starts.
You'll see that encrypt is called from within here.
So here we set up some variables, including getting the
bitmap from our image view and also setting up array for the
new RGB colors.
They were gonna build a new bitmap out of.
And then.
We will do a quick check of the message link to see if it's too
long to store within our image because remember, since each
character of the message needs eight different pixels, since
we're only storing 1 bit per pixel, it's going to be 1/8 of
the total pixels minus the three bytes that we need to store our
ending tag.
Then we encrypt the message.
As you can see here.
We start iterating through the pixels of the image down here.
The color code variable is determined by the user selection
of a red, green, or blue radio button that you'll see in the
app when I run it.
Here O depending on that we retrieve the value that we're
interested in, and then we set the least significant bit of
that component.
To the current bit of our message and if I Scroll down
here.
You can see that helper function to set the least significant
bit.
Just turns into a binary string.
Chops the last one off, adds what we want and returns it.
So back up.
Two year after we've added the bit to the appropriate color, we
update our indexes Advent color to the new color list and then
once we're done, we use that new color list to build our new
bitmap.
So now it's time to retrieve a message from the image and the
high level process will generally be to again iterate
over each pixel, this time retrieving the least significant
bit from each color value byte of the color we're interested in
and building them up into a byte array and ultimately a string.
And remember, we can stop reading the pixels once we hit
the three byte flag that we put as an ending signal, and then we
will have our encrypted message which we can pass back to our
exclusive or decryption.
So now back to the code.
Here's our function.
Our decode function that gets the message from the image.
First, we set up our rolling array of three bytes that will
we use to check against those three ending bytes.
So we know when we're done reading.
Again, we iterate through each pixel, get the color value, and
then from that the least significant bit of whichever
color we're focusing on, and add that to a string of bits.
Again, we have a bit counter here to keep track, so once we
have 8 bits, we update our last three bytes and add the current
bytes to our result, then reset the bitstring and the index and
repeat until the last three bytes array contains our ending
bytes.
Now we have our decrypted message here.
So we pass it to our decrypt function down here, which again
is exactly the same.
As I said, this time, if we do the same exclusive or operation
with the encrypted message exclusive or password, the
result will be the original unencrypted message.
So finally, I'll do a quick demo here just to show that this
actually works.
So we'll go ahead, build and run the program.
Yeah, I don't know if you saw my splash screen, but it is a stick
source, so here I have a default image that I use.
And we'll just go ahead and encode some messages in various
channels.
Given.
Passwords like red password, green password, blue password.
So then I hidden code you can see now it has been in coded and
that image is the new image.
Although you probably can't tell.
So now switch to the green.
And I'll put a distinct message and password in the green.
Encode that.
And finally do the same for the blue.
Now that I have all those in there, I'll just go ahead and
copy this new image with all the messages embedded and I'll swipe
over to my D code tab here.
As you can see, it's got the same image by default, but we
can go ahead and see.
This one doesn't have the messages on it.
Nothing.
But if I go ahead and paste what I have here.
Then decode.
Now we get the Red Channel secret message.
Check the green and all intentionally use the wrong
password on the green here and you see without the right
password you just get a garbled.
But if I go back and use the correct password.
Now we're getting the green message.
And finally.
That's what was it.
There it is, the blue message.
And so as you can see, it's mostly meant to be interacted
with, copy and paste and share.
There is functions to load and save, but I think it's much
easier to copy paste and then also use the share button we can
integrate with anything you might be using any social media,
messaging or whatever.
And so that's it.
So finally just to wrap up, as I mentioned before, I did notice a
lot of things that needed fixing.
So I have sort of A to do list with this one big thing is
deprecated methods because the Android API changes very
quickly.
So if you've left something sit for a year, you're probably
going to come back and find lots of things that you need to do in
the new the new way.
Also, the main thing I need to do is I have these encode and
decode operations which are long running but they are running on
the main thread so you couldn't really notice it when I was
doing the demo earlier because I have a pretty decent laptop but
running the same app on my low quality physical Android phone,
those operations freeze the UI for several seconds.
So I need to put them on a separate thread and put up a
some sort of progress bar just to let the user know what's
going on.
Also view binding could eliminate a lot of the
boilerplate code that I saw.
I saw a lot of view declarations that didn't need to be in there,
so that would be an easy fix as well.
And finally, here's credit to the theme I used, and that's all
I have.
Thank you.
That was really cool, wasn't it?
I'm impressed.
I wish we were able to do that when he was in the internship,
but I promised him that I would show it.
At another time and now it will be on PGIP pods at some point
too.
We do put master class on PGIP pods that will be our last one
for this evening.
I did have another one, but I have to put it together.
It's audio, it's separate audio and video O I'll have to put
that together before I can show it, but I want to say
congratulations to all the presenters this evening.
Great job.
Excellent work.
Lots of information.
I love it.
Every time I did such a great job, everybody be proud of what
you have accomplished.
Getting past those nerves, right.
You gotta fight through it.
So does anybody have any questions for any of our
presenters this evening?
Yeah, that's a great stuff.
I know I learned so much every time.
It's wonderful.
All right.
Well, then I will say thank you for everybody joining and
getting to watch some great presentations from all our
wonderful interns.
Such big brains.
It's wonderful.
I love the research that you guys have put into this and and
giving us that information.
Excellent.
Have a great evening everybody.
Umm and.
See you around the business, huh?
And now the company.
Have a great night.