BlackHat according to Twitter

For the first time in a decade I didn't attend BlackHat USA in Las Vegas. I learned that South Africa in August is much colder than i recalled, but also had the chance to observe the conference from through a twitter-lense.


It seemed as if there was more talk about parties, than content so I decided to grab all the tweets i could (#blackhat through the twitter search API) to do some simple grouping*.


Whats clear straight off is that my intuition was wrong. Although party talk makes up a significant percent of all tweets, tweets about "talks & training" clearly dominate. (This possibly means that i need to start following a better class of hax0r)


A quick explanation of the grouping (which was done pretty coarsely):
  • Talks & Training : Tweets related to a talk (or training session)
  • Misc : (General catch-all for tweets about coffee / *)
  • Spam : People who stole the hashtag to push traffic to their own site (used by quite a few big name vendors to draw traffic to their reports *cough* shady rat *cough*
  • Pimpage : Speakers / Vendors / People shamelessly self promoting
  • Vegas/Parties/Social : This are the typical "Vegas Baby!" tweets
  • Bluehat Prize : This are tweets about the Microsoft Bluehat prize
  • Not There : Tweets from people who wish they were at BlackHat
  • Recruitment : erm.. recruitment related
  • Pwnies : pwnies related tweets
  • BoothBabes : the kerfuffle over McAfees use of booth babes
  • anonymous,antisec,lulzsec : Tweets about Anon doing BlackHat
Since we have this data, we can extract some other (arb) pieces of information like:
Most commonly used words in tweets about "talks & training"


(this is a quick (cheap) way for us to see which talks /speakers dominated the twittersphere)


It also (kinda) interestingly allows us to list the top tweeters by volume (with 1318 individual tweeters in total):
  • 36 @TechJournalist
  • 32 @wireheadlance
  • 30 @chriseng
  • 25 @jadedsecurity
  • 23 @IOActive
  • 21 @Llana
  • 18 @click_finders
  • 18 @cindyv
  • 18 @bdognet
  • 18 @InsiderThreats
Finally (because we couldn't help but add another pie graph,) we can check the most popular twitter clients used to create this traffic:


(Its worth noting that we only grabbed data for the #blackhat hashtag. This is in part because it was most obvious, and in part because we were afraid to grab the results of #barcon)


You should follow me on twitter: here


* We made use of the python twitter module. You can download a python pickle object here, which is a dictionary of all tweets snagged.




Comments

  1. Anonymous9 August 2011 at 18:32

    Look for hashtag #blackhat2011 too , @daniel_bilar tweeted info almost every talk

    ReplyDelete
  2. MH9 August 2011 at 18:34

    bah! i looked to @blackhatevents to spot the hashtag they were using. Going to go back to real work now (my boss is an ass!)

    ReplyDelete

Post a Comment

Popular posts from this blog

Simple Graphs with Arbor.js

Image
We recently released a tool at http://cc.thinkst.com to capture and collect infosec conference details. We commented on it [ here ]. One of the cooler components of it, is the ability to view the relationships between speakers/researchers who have collaborated. This post is a quick introduction to the library we used to build our graphs, with enough info to get you up and running in minutes. As I mentioned, we use ArborJS library which is a a graph visualization library using web workers and the popular jQuery . The API is really well documented [ here ] but like most people, I learn best by example (and there are precious few of these). Hopefully this post will fill that niche, and by the end of it you should have a basic understanding of how to use arbor.js in your project. Our Aim: We will be building a simple contrived example as seen in the image above. Project setup : Create a new html page and include script references to the following libraries (Download them from the links...
Read more

Using the Linux Audit System to detect badness

Image
Security vendors have a mediocre track record in keeping their own applications and infrastructure safe. As a security product company, we need to make sure that we don’t get compromised. But we also need to plan for the horrible event that a customer console is compromised, at which point the goal is to quickly detect the breach. This post talks about how we use Linux's Audit System (LAS) along with ELK (Elasticsearch, Logstash, and Kibana) to help us achieve this goal. Background Every Canary customer has multiple Canaries on their network (physical, virtual, cloud) that reports in to their console which is hosted in AWS. Consoles are single tenant, hardened instances that live in an AWS region. This architecture choice means that a single customer console being compromised, won’t translate to a compromise of other customer consoles. ( In fact, customers would not trivially even discover other customer consoles, but that's irrelevant for this post. ) Hundreds of consoles runn...
Read more

Good UNIX tools

Image
aka:   Small things done well  We spend a lot of time sweating the details when we build Canary. From our user flows to our dialogues, we try hard to make sure that there’s very few opportunities for users to be stuck or confused. We also never add features just because they sound cool. Do you “explode malware”? No.  Export to STYX? No.  Darknet AI IOCs? No. No. No..  Vendors add rafts of “check-list-development” features as a crutch. They hope that one more integration (or one more buzz-word) can help make the sale. This is why enterprise software looks like it does, and why it’s probably the most insecure software on your network. This also leads to a complete lack of focus. To quote industry curmudgeon (and all around smartypants) Kelly Shortridge : " it is better to whole-ass one thing than to half-ass many" . We feel this deeply. Most of us cut our teeth on UNIX and UNIX clones and cling pretty fastidiously to the original Unix philosophies ¹ : Make each...
Read more