Welcome Our New A.I. Overlords with Ed Skoudis | CypherCon 4.0

### Overview In this presentation at CypherCon 4.0, Ed Skoudis explores the intersection of cloud data storage, machine learning, artificial intelligence, and personal privacy. Drawing inspiration from a classic Simpsons quote, Skoudis examines how modern technology platforms have become deeply integrated into everyday human life. He discusses cloud security incidents resulting from misconfiguration, how major cloud providers leverage machine learning to protect data, and the broader societal implications of personal data weaponization by technology giants.

### Key Topics - **Cloud Storage Breaches and Misconfigurations**: Cloud storage platforms like Amazon S3, Microsoft Azure Cloud Storage, and Google Cloud Storage offer massive scale, but misconfigurations have led to high-profile data exposures. Examples include Uber in October 2016 (57 million records accessed via compromised GitHub developer credentials leading to an S3 bucket), the U.S. Army in September 2017 (100 GB of sensitive military data in a public S3 bucket), FedEx subsidiary Bongo in February 2018 (119,000 driver's licenses), and Cultura Colectiva's exposed S3 bucket in 2019 containing 540 million Facebook user records. - **AI and ML Defensive Tools in the Cloud**: Major cloud providers use multi-tenancy and machine learning to analyze normal access patterns and detect anomalies. Skoudis highlights three distinct vendor approaches and pricing models: - *Amazon Macie*: Uses machine learning to crawl data, locate sensitive intellectual property and PII, and monitor access via CloudWatch ($5 per GB protected plus $4 per 100,000 events analyzed). - *Microsoft Azure SQL Database Threat Detection*: Employs ML to detect anomalous database queries and attacks such as SQL injection ($15 per database). - *Google Cloud Data Loss Prevention (DLP) API*: Uses context clues and ML to identify roughly 70 types of PII, billed via inspection/transformation units (10 giga units free, then $0.30 per giga unit). - **The 'Big Four' Tech Titans**: Citing NYU professor Scott Galloway, Skoudis classifies the dominant tech companies by what they appeal to: Google (brain/mind), Facebook (heart), Amazon (belly/desires), and Apple (sensuality/design). Unlike advertising- and data-driven business models, Apple publicly emphasizes privacy to differentiate itself and sell hardware. - **Data Weaponization and Ubiquitous AI**: Massive datasets have been weaponized for political profiling (e.g., Cambridge Analytica's correlations of likes such as KitKat bars or Nike shoes), facial recognition (Russian firms scraping Facebook photos), and intelligence gathering (OPM breach exposing 22 million records including fingerprints; Equifax breach of 145 million records). Ubiquitous smart assistants (Amazon Alexa, Google Home, Apple Siri) continuously observe personal habits, medical queries, routines, and media consumption.

### Technical Details Skoudis notes that while cloud multi-tenancy allows one customer's anomaly detection to feed another's threat prevention, reliance on providers creates potential competitive friction—especially with Amazon entering retail, groceries, and pharmaceuticals. Furthermore, services like YouTube optimize recommendation algorithms through real-time feedback loops specifically designed to maximize user watch time and advertising exposure, creating pervasive behavioral tracking.

### Takeaways To mitigate surveillance and data loss risks, Skoudis advises users to: - Personify AI tools and platforms (imagining platform executives on the other end) to be more mindful of what information is shared. - Explore and support privacy-respecting alternatives, such as alternative search engines (DuckDuckGo, Bing) or privacy-focused vendors. - Recognize the friction of fully disconnecting from major platforms (such as Google or social media networks) and instead advocate through public discourse. - Participate in community cyber ranges such as Counter Hack's annual Holiday Hack Challenge and KringleCon to build offensive and defensive skills.