[00:08.410 --> 00:10.510]  All right. Can everybody hear me okay?
[00:12.870 --> 00:17.130]  Louder? Should I scream? Should I sing?
[00:19.450 --> 00:20.890]  Somebody's listening to the show.
[00:22.630 --> 00:24.590]  All right. I will try to
[00:24.590 --> 00:28.490]  speak up, so I'll watch the back if anybody wants me to get louder.
[00:29.670 --> 00:32.530]  Okay. And there's one announcement. They say the
[00:32.530 --> 00:37.090]  tent is running about a half an hour behind schedule, so just to let everybody know that.
[00:38.210 --> 00:40.790]  And I guess I'll get started, and
[00:40.790 --> 00:43.830]  I am Sank Dog, as you can see on the board there.
[00:48.640 --> 00:50.340]  Great. Now I've got to live up to that.
[00:51.380 --> 00:54.880]  And this presentation is on hacking Google AdWords.
[00:54.880 --> 00:58.700]  And let me clarify right up front, this is not Google hacking.
[00:58.780 --> 01:02.980]  I think Google hacking has kind of been done to death, and I think everybody in here knows what
[01:02.980 --> 01:07.080]  Google hacking is, and we can make databases and lists of stuff all day long. That's not what this
[01:07.080 --> 01:09.520]  is about. So just to say that up front.
[01:12.000 --> 01:14.760]  I got interested in this and started doing research on
[01:15.260 --> 01:19.520]  AdWords in general just because I was curious as to how it worked.
[01:19.540 --> 01:23.120]  I wanted to see if we could get publicity for the magazine and for the
[01:23.120 --> 01:27.160]  website. Not really an advertising thing exactly, I just kind of
[01:27.160 --> 01:31.600]  wanted to see how it worked and do a little bit of research on it, so I figured, what the heck, I dropped 20 bucks on it.
[01:32.120 --> 01:35.120]  And I kind of, A, I didn't like the way some of the things
[01:35.120 --> 01:38.720]  that it did, and B, they made me mad.
[01:38.720 --> 01:42.620]  So I decided to do a little research, and that's why I'm doing this presentation.
[01:43.320 --> 01:46.800]  So, again, it's not Google hacking.
[01:46.900 --> 01:51.060]  And actually, disclaimer, I just put this in because
[01:51.880 --> 01:54.440]  of some recent activities by Google.
[01:54.780 --> 01:59.060]  First of all, I'm going to read these out loud, but you can see them on the screen. I'm not
[01:59.060 --> 02:03.260]  representing Google or Google AdWords in any way, shape, or form. I'm not affiliated with them.
[02:03.260 --> 02:07.280]  I have no association with them whatsoever. This is not condoned or anything by them.
[02:07.500 --> 02:11.180]  I do not have their authorization. The terms Google and Google
[02:11.180 --> 02:14.340]  AdWords are both trademarked of Google Incorporated.
[02:16.880 --> 02:19.400]  No, I do not. I couldn't
[02:19.400 --> 02:23.200]  afford it, are you kidding? And yeah, this presentation is just
[02:23.200 --> 02:27.240]  research I did as a user, creating an account, trying some different
[02:27.240 --> 02:31.680]  things, trial and error as they kept canceling my accounts and I kept recreating new accounts.
[02:31.680 --> 02:35.520]  And we went this whole back and forth game. So that's how most of this stuff came about.
[02:35.520 --> 02:39.520]  I wanted to put that up because, as you can see on the next slide,
[02:39.520 --> 02:43.680]  very recently I've had some activity with this. On the 10th
[02:43.680 --> 02:47.420]  of June, this presentation was listed on the DEF CON website
[02:47.420 --> 02:51.960]  and on my websites and things like that. And shortly thereafter,
[02:51.960 --> 02:55.740]  the end of June 31st, Google AdWords changed their terms of service.
[02:56.000 --> 03:00.020]  And they make it very clear that if I want to use the terms, I have to say trademark.
[03:00.020 --> 03:03.360]  So that's why I put that in there to make sure I'm covered from a legal standpoint.
[03:03.940 --> 03:07.700]  And then again on the 15th, which was a couple weeks ago,
[03:07.700 --> 03:11.880]  they sent out an email saying that they're actually changing some of the characteristics
[03:11.880 --> 03:16.240]  of the AdWords program. So I have made some updates, there's some extra comments
[03:16.240 --> 03:20.220]  in these slides from when I created them, some things that have changed, and I will refer to those
[03:20.220 --> 03:24.160]  when the time comes. For the most part, everything's still fairly accurate, but they are in the
[03:24.160 --> 03:28.080]  process of changing it, which is actually going to be, it's a good thing. So that's really what we
[03:28.080 --> 03:31.720]  want them to do. So, to start off with,
[03:31.720 --> 03:36.120]  I'll try to go through this quickly because I know everybody in here kind of doesn't want to hear what is Google
[03:36.120 --> 03:40.140]  AdWords stuff. So I'll just go quickly through this. First of all, it's just an advertising program.
[03:40.720 --> 03:44.080]  It's biggest competitor is Overture, which is the one that's used by Yahoo and
[03:44.080 --> 03:47.960]  MSN. There's a lot of other ones out there. They all act pretty much the same.
[03:47.960 --> 03:52.100]  It's a pay-per-click system. And pay-per-click, if anybody doesn't
[03:52.100 --> 03:56.160]  know, you might want to hit the exits because it's pretty self-explanatory. You pay
[03:56.160 --> 03:58.200]  every time somebody clicks on one of the ads.
[04:00.140 --> 04:03.760]  There are a couple other terms that I want to define in here.
[04:04.480 --> 04:08.120]  Impressions. Impression is any time an ad gets shown on a page.
[04:08.160 --> 04:12.180]  Again, kind of self-explanatory, but we're going to refer to these later on in the presentation,
[04:12.180 --> 04:16.100]  so keep them in mind. An impression is any time the ad actually shows on the side
[04:16.100 --> 04:20.240]  of the screen. And we've got some screenshots coming up to show some of these. And again, a click-through
[04:20.240 --> 04:24.120]  is self-explanatory is when they actually click through it. And there's one
[04:24.120 --> 04:28.040]  other term that they use, it's called a click-through ratio, which once again
[04:28.040 --> 04:32.020]  common sense tells you that's out of how many ads get shown, how many do you actually
[04:32.020 --> 04:36.460]  click through. So, yeah, we'll zip through that real quick. It's a
[04:36.460 --> 04:40.500]  customizable system, of course, and it's used by Google
[04:40.500 --> 04:44.440]  obviously, but also by Gmail. You see the ads in Gmail, that's also
[04:44.440 --> 04:48.240]  pulling from this from Google Groups. Google AdSense also will pull
[04:48.240 --> 04:52.120]  from these now. And a lot of outside sites, and this is an important fact to
[04:52.120 --> 04:55.920]  keep in mind also because, and I'll refer back to this when it becomes appropriate, but
[04:57.060 --> 04:59.920]  it's Google AdWords program, but it's not only on Google
[04:59.920 --> 05:04.100]  or Google-owned or affiliated sites. They, of course, sell this out to other
[05:04.100 --> 05:07.680]  companies like Ask Jeeves, for example, is one that I've noticed them on.
[05:08.200 --> 05:11.960]  I think maybe CNET, although they change contracts sometimes here to there, so
[05:11.960 --> 05:16.000]  you open up an AdWords account, you can get those ads on a lot. Anybody who uses
[05:16.000 --> 05:19.800]  the AdWords or AdSense, so your ads will get a lot. It's a pretty big program.
[05:19.800 --> 05:23.600]  I mean, it's the biggest. Overture is second and by a long shot.
[05:24.320 --> 05:27.820]  How does it work? 20 bucks up front.
[05:27.920 --> 05:31.820]  I figured, you know, 20 bucks, that's not a big commitment. I'll drop 20 bones on that.
[05:32.120 --> 05:35.620]  And it's kind of, it's basically prepaying to enter the program.
[05:35.620 --> 05:39.520]  You put 20 bucks up front, they're going to take 5 bucks right off the top for an activation fee
[05:39.520 --> 05:43.540]  just to create the account. Why do you charge an application fee to create an electronic
[05:43.540 --> 05:47.600]  account with nobody's hands involved? I don't know. I've been trying to figure that out from banks
[05:47.600 --> 05:51.720]  for years, why they want to charge me transaction fees for every little thing, but
[05:51.720 --> 05:53.400]  that's a whole other topic.
[05:55.220 --> 05:59.700]  And the other 15 bucks you get credited towards your account. And what that means
[05:59.700 --> 06:03.680]  exactly is, you're going to have that 15 dollars and as you go
[06:03.680 --> 06:07.680]  through it and your money runs out of it, then you can reload the account, prepay it again.
[06:07.880 --> 06:12.120]  And what I mean by going through that money is this is a pay-per-click system, as I mentioned earlier.
[06:12.120 --> 06:15.640]  And it's based on a bidding system. The minimum bid you can put
[06:15.640 --> 06:19.580]  on there is 5 cents at this time. Again, that's one of the things they might be changing
[06:19.580 --> 06:23.540]  soon. But the minimum bid is 5 cents. And for stuff like I'm
[06:23.540 --> 06:27.640]  advertising a hacking site, they don't really...
[06:34.150 --> 06:35.710]  Overture is 10 cents. Google
[06:35.710 --> 06:39.830]  AdWords is 5 cents. I created my account 6 months ago or so, so
[06:39.830 --> 06:43.610]  if they've changed since then, yeah, I wouldn't... I don't know.
[06:43.610 --> 06:46.450]  I don't know if that's the case or not, but...
[06:46.450 --> 06:49.650]  Okay. Let's see.
[06:50.990 --> 06:54.190]  Pay-per-click system, yeah, minimum of 5 cents. And for people like me and
[06:54.190 --> 06:58.310]  my small sites, I'm getting keywords like hacking magazine,
[06:58.310 --> 07:02.470]  freaking magazine, radio show, things like that. I'm getting them for the lowest bid. There's no
[07:02.470 --> 07:06.250]  competition for those. Alright,
[07:06.250 --> 07:10.530]  binrev.com, B-I-N-R-E-V.com, thank you. I'm sure that... I'll put that at the
[07:10.530 --> 07:13.670]  very end. I'll keep the flow going for this pretty well.
[07:14.130 --> 07:17.650]  But, yeah, for most obscure keywords, it costs you about a nickel or
[07:17.650 --> 07:21.590]  possibly a dime, whatever the case is now, to get your ad
[07:21.590 --> 07:26.110]  out there. That's what you bid, and if somebody clicks through that ad, basically that's what you'll pay in this scenario.
[07:27.050 --> 07:29.950]  Now, other keywords,
[07:29.950 --> 07:33.610]  obviously it's a different story. It's kind of an auction where the highest bidder gets the
[07:33.610 --> 07:37.650]  highest placement on the website. So when you see, and I'm sure... Has anybody here hasn't
[07:37.650 --> 07:40.630]  used Google? No one? Okay.
[07:42.610 --> 07:44.270]  On the right-hand side, of course...
[07:44.270 --> 07:48.510]  And the other thing that's funny about this is you get so you don't even notice the ads anyway. You just block them out
[07:48.510 --> 07:52.630]  anyway. So that's a whole other topic. But on the right-hand side, you'll
[07:52.630 --> 07:56.590]  get those ads, or even at the top, the sponsored links. And again,
[07:56.590 --> 08:00.570]  on other sites, they could be placed anywhere on the page. You've seen ads by
[08:00.570 --> 08:04.550]  Google, sponsored by Google, stuff like that. So they can be in any form,
[08:04.550 --> 08:08.270]  but for the most part, it's the same bidding system no matter what.
[08:08.730 --> 08:12.350]  Now again, for my words, it's like a nickel, or less. And I'm like the
[08:12.350 --> 08:16.290]  only ad, usually, for the most part. Maybe two or three others. And actually, you'll
[08:16.290 --> 08:20.210]  see some pretty funny... This is going to be a pretty light-hearted presentation, by the way. There's going to be some funny stuff coming up.
[08:20.210 --> 08:23.150]  So I hope everybody's not in too much of a serious mood.
[08:24.910 --> 08:28.390]  Oh, I found this interesting. Maybe this is just a trivia, kind of
[08:28.490 --> 08:32.270]  a side note. But you know what some of the most... the keywords that get the highest
[08:32.270 --> 08:34.050]  bid are all relating to?
[08:37.370 --> 08:37.770]  Well...
[08:37.770 --> 08:42.030]  I would have thought porn, too. That's the first thing I thought, too. But
[08:42.030 --> 08:45.910]  actually, it's not so much. It's anything legal.
[08:46.030 --> 08:49.950]  Things like class action lawsuit, the phrase slip and fall,
[08:49.950 --> 08:53.930]  things like that are always pretty consistently high. And the highest one, yes, is
[08:53.930 --> 08:58.110]  mesothelioma right there. Mesothelioma, which I had to look up because I had
[08:58.110 --> 09:02.090]  no clue what it was, is actually a form of cancer that comes from
[09:02.090 --> 09:06.050]  asbestos. So it's still related to the lawyers. They're chasing the ambulance trying to get these
[09:06.050 --> 09:10.410]  class action suits. And they're bidding upwards of $40, sometimes higher. It fluctuates
[09:10.870 --> 09:13.390]  for every click through on one of these ads. $40
[09:13.950 --> 09:17.970]  to click through on that. Because if they make a multi-million dollar lawsuit, obviously
[09:17.970 --> 09:22.090]  it becomes worth their while. And a couple of
[09:22.090 --> 09:25.990]  the other ones are, which also surprised me, is web hosting,
[09:25.990 --> 09:30.050]  search engine, search engine optimization, things like that. They also get consistently
[09:30.050 --> 09:34.150]  high bids as well. Considering there's a lot of markup there, I guess they have some freedom
[09:34.150 --> 09:38.090]  with that. And what else? There's a minimum
[09:38.090 --> 09:42.150]  or excuse me, a maximum daily spending value that you can set. You can tell
[09:42.150 --> 09:45.390]  how much that, like say you put $40 on your ad and you only want
[09:46.030 --> 09:50.130]  one a day, you can only afford one, you can put a limit of $40. Once that click
[09:50.130 --> 09:54.210]  through is gone, it'll never show up for another 24 hours. So for
[09:54.210 --> 09:58.090]  my nickel ones, you know, you click on those for a long time, it's not really going to cost me all that
[09:58.090 --> 10:02.150]  much. But for the record, if anybody wants to be a smart ass, I do have a limit on there.
[10:02.910 --> 10:05.110]  I know some of you.
[10:06.550 --> 10:10.210]  And let's see, obviously higher bid, the more you bid on it
[10:10.210 --> 10:14.290]  it's going to put you higher in the ranking, so that kind of makes common sense. And it also
[10:14.290 --> 10:17.890]  calculates how much you bid with how successful your ad is or how many
[10:17.890 --> 10:22.250]  click throughs. If you have a higher click through ratio, it paid a little less, it'll kind of play around
[10:22.250 --> 10:26.150]  with that a little bit. And let's see, that's about
[10:26.150 --> 10:30.090]  it. If you go on to the next one, I'll talk about a little bit
[10:30.090 --> 10:32.070]  about how the campaign system works.
[10:34.450 --> 10:38.050]  Basically, campaigns are just a logical breakdown. Just to kind of help you
[10:38.050 --> 10:42.330]  if you have multiple different topics. You might want to create a
[10:42.330 --> 10:46.190]  different campaign for each one of those topics. And again, I'm going to go
[10:46.190 --> 10:50.110]  through this really quickly because this is all...unless you're actually going to make one of these
[10:50.670 --> 10:54.110]  and this presentation is...I hope there's some people out there that actually maybe want to do
[10:54.110 --> 10:58.010]  this and want to learn how to better use the Google AdWords system. There are
[10:58.010 --> 11:02.130]  companies out there that charge hundreds and thousands of dollars to give you lessons on how
[11:02.130 --> 11:05.410]  to optimize your ads and stuff like that. I'm going to give you some tips on here
[11:05.930 --> 11:10.090]  free, and this will be downloadable in everywhere you can get your hands on this, that
[11:10.090 --> 11:14.090]  they're charging hundreds and hundreds of dollars for. And I've got some that they've...I've never seen addressed by
[11:14.090 --> 11:18.150]  some of them before. So if you're actually considering coming here for some useful information,
[11:18.150 --> 11:22.050]  hopefully I'll have that some in here as well, as well as some fun stuff. And
[11:22.050 --> 11:26.310]  some questionable stuff, but I'll leave that for later.
[11:28.190 --> 11:30.070]  Let's see...so...and within the different
[11:30.070 --> 11:33.970]  campaigns, you can create different ad groups. Like for a campaign, I think of it like
[11:33.970 --> 11:38.010]  if you're a webmaster or a web hosting company and you're offering that service for
[11:38.010 --> 11:41.970]  your clients, you'll create a campaign for client A, a campaign for client B and C.
[11:41.990 --> 11:45.750]  Logical breakdown of your different clients. With the ad groups, you know,
[11:45.750 --> 11:50.050]  the best example I can think of is you have a card company, you sell new and used
[11:50.050 --> 11:54.090]  cards. Well, your ads for each one of those is going to be different keywords. You don't want
[11:54.090 --> 11:58.250]  you know, if somebody types in used cars, you don't want to show them an ad for new cars.
[11:58.370 --> 12:02.270]  It makes common sense. So that's where you break down and make a different ad group for each one.
[12:02.270 --> 12:06.170]  And again, from my site, I have a different one for radio, a different one for magazine,
[12:06.270 --> 12:10.010]  a different one for, you know, a few different keywords. And I show a different ad based on those
[12:10.010 --> 12:13.610]  keywords. So that's basically how it works.
[12:14.370 --> 12:18.170]  Oh, and I do have one update here. It's one of the things I mentioned they've changed since
[12:18.170 --> 12:22.450]  the 15th. They actually have added something called site targeted ads
[12:22.450 --> 12:26.190]  now. Early on when I was testing, you could do
[12:26.350 --> 12:30.310]  a little bit of Google hacking. I said I wasn't going to refer to that, I lied. You do a little
[12:30.310 --> 12:34.010]  bit of Google hacking to kind of limit it to a site, a particular site with a site colon
[12:34.590 --> 12:37.750]  to kind of target your ads a little bit. Very
[12:38.170 --> 12:42.510]  mixed success. Well, now they have something called site targeted ads
[12:42.510 --> 12:46.170]  where you can go in there and they give you a list, which is actually kind of
[12:46.170 --> 12:49.870]  interesting, they give you a list of everybody that participates in their advertising program
[12:50.470 --> 12:54.290]  which you can't really find that information anywhere, but when you go in there you put in a few keywords
[12:55.090 --> 12:58.130]  or an example site and you will get a list
[12:58.130 --> 13:01.950]  of sites that they think are associated with that. So I put in
[13:01.950 --> 13:05.990]  hacking magazine, it might come up with a bunch of different security sites, hacking sites, etc.
[13:07.070 --> 13:10.330]  So it's kind of interesting to see. This gives you a list of people that are using
[13:10.710 --> 13:14.170]  AdSense or that are paying for their program. So that's kind of interesting information. You can
[13:14.170 --> 13:18.110]  know what your competition, are they using AdSense? And if so, what keywords
[13:18.110 --> 13:22.190]  they have associated with them. You can kind of go work backwards and kind of
[13:23.090 --> 13:26.190]  reverse engineer, for lack of a better word, kind of work backwards to the system to see what
[13:26.190 --> 13:29.370]  your competitors are doing. So that's kind of interesting.
[13:30.710 --> 13:33.990]  But, what's the problem with this? Okay, so now we get into
[13:33.990 --> 13:38.050]  some of my... I'll try not to rant. Again, people who know me know I can
[13:38.050 --> 13:42.170]  go off a little bit. I'm going to try to keep that down, but basically I have some problems with
[13:42.170 --> 13:46.230]  the way they run the thing. And some of these, again, have changed for the
[13:46.230 --> 13:49.330]  better. Basically it's
[13:50.230 --> 13:53.750]  they killed me a couple times with something called reactivation fees.
[13:54.050 --> 13:58.290]  So again, $20 up front, $5 to get it started. You only got $15 credit. It doesn't go
[13:58.290 --> 14:01.230]  too awful far. It goes pretty far with a nickel a pop.
[14:01.870 --> 14:06.110]  But what happens is that click-through ratio I mentioned earlier, which is the
[14:06.110 --> 14:10.050]  percentage of people that see the ad that click through the ad, you have to maintain a click-through
[14:10.050 --> 14:14.070]  ratio of .05. Basically you have to get two clicks for every
[14:14.430 --> 14:18.150]  I'm sorry, one click for every 200, I think it is, .05%. And if you
[14:18.150 --> 14:22.130]  don't, they will do something called slowing your ads. Well, the problem with this, what
[14:22.130 --> 14:26.070]  made me mad is I go in there, I set up my account, I'm a noob, I don't know what I'm doing,
[14:26.070 --> 14:29.970]  I'm setting up keywords. I come back the next day, I've got, you know, a couple hundred hits on the site
[14:29.970 --> 14:34.150]  and it generates a lot of hits, no doubt about that. But the click-through
[14:34.150 --> 14:38.090]  ratio wasn't high enough and they had slowed my ad. And slowing it means they're not going to show
[14:38.090 --> 14:41.930]  it to as many people because you're not performing well. Even though there's no competition
[14:41.930 --> 14:45.910]  and there's nobody I'm competing against, I'm not performing as well as
[14:45.910 --> 14:49.770]  blank space apparently. Thanks a lot Google, I appreciate that.
[14:50.070 --> 14:53.630]  So, let's see. I
[14:54.190 --> 14:58.250]  went in, recreated the, there's a little thing in there that says
[14:58.250 --> 15:02.010]  to reactivate the word. If it happens three times, they charge you a $5 fee.
[15:02.970 --> 15:06.190]  So I got real mad because I was having to go in every day, sometimes
[15:06.190 --> 15:10.350]  two or three times a day and reactivate my ads so that they don't
[15:10.350 --> 15:13.790]  get me that $5 fee or take the ad out of my keyword list
[15:13.790 --> 15:18.030]  because if it goes to slow then I keep getting these fees. So, that kind of made me mad
[15:18.030 --> 15:22.070]  first of all. The second thing is, and then
[15:22.070 --> 15:25.430]  this is an update they've made. They're kind of changing that system.
[15:27.570 --> 15:29.810]  They announced that they're going to go away from the whole slowing
[15:29.810 --> 15:33.870]  thing. And this just happened again. Email went out, I think on the 15th I got it
[15:33.870 --> 15:39.350]  saying that they're going to get rid of these slowing accounts and they're going to something called a
[15:39.350 --> 15:42.070]  quality score. What that is, we don't know yet.
[15:42.070 --> 15:45.950]  They haven't really implemented it exactly. It's coming soon. Whatever that means. Probably
[15:46.630 --> 15:50.110]  today at 4 o'clock after I'm done with this maybe. So, I don't
[15:50.110 --> 15:54.110]  know what defines a quality score. So, hopefully we'll find that
[15:54.110 --> 15:58.910]  out soon. So, that is something that has changed since this. So, be aware of that.
[15:58.910 --> 16:01.970]  The other problem is, and this is, I'll
[16:01.970 --> 16:05.090]  try not to, I'll try to stay calm with this, but basically
[16:05.510 --> 16:09.930]  the terms of service. Now, I'm not naive. I didn't just fall off the turnip truck. I know every
[16:09.930 --> 16:13.970]  site has no hacking or cracking rules in it. We all know that.
[16:14.290 --> 16:18.050]  It's not such a big deal. But, the problem
[16:18.050 --> 16:21.190]  with Google, and I'll read you the exact quote.
[16:24.150 --> 16:25.130]  Let's see. We have
[16:26.410 --> 16:29.990]  Google AdWords ad policy in order to maintain the quality of advertising
[16:29.990 --> 16:33.890]  we display and encourage users to continually click on ads and increase
[16:33.890 --> 16:37.890]  advertisers return on investment. Our goal is to make the information seeking
[16:37.890 --> 16:42.170]  process more efficient and relevant and to protect both our advertisers and users
[16:42.170 --> 16:46.030]  in a fair advertising environment. As a result,
[16:46.030 --> 16:49.530]  we cannot promote ads or ads for websites that promote, quote,
[16:49.530 --> 16:53.990]  hacking and cracking. As noted in
[16:53.990 --> 16:57.950]  our advertising terms and conditions, Google reserves the right to exercise editorial discretion
[16:57.950 --> 17:02.030]  when it comes to the advertising we accept on our site. Again, standard. We know that kind of
[17:02.030 --> 17:04.990]  happens. But, I guess, maybe
[17:06.830 --> 17:09.910]  A, maybe we hold Google to a kind of a higher standard because
[17:09.910 --> 17:13.490]  Google seems to be, they kind of act hacker friendly. Not
[17:14.090 --> 17:17.750]  directly, but I mean, I think everybody kind of knows what I mean. There's so much you can do and it's so flexible
[17:17.750 --> 17:22.010]  and they seem to provide APIs and a lot of code and stuff, so you kind of think of that.
[17:22.210 --> 17:25.850]  But, the bigger problem I had is the fact, when I said, when I did this hacking
[17:25.850 --> 17:29.890]  or cracking, they put that, in quotes, together. Like,
[17:29.890 --> 17:33.910]  there's not a difference between hacking and cracking. They put them together as though
[17:33.910 --> 17:37.830]  they're one synonymous term. And I just, I have a problem with that. I always
[17:37.830 --> 17:41.910]  have had a problem with that. They're two different things. So, I did email
[17:41.910 --> 17:45.950]  them and tried to explain the difference to them that, you know, it's a hacking
[17:45.950 --> 17:49.970]  site, but we don't promote cracking. We don't promote illegal activity or anything like that on the site
[17:49.970 --> 17:53.890]  in the magazine or in general. You know, try to, I know some people think it's
[17:53.950 --> 17:58.070]  a lost cause to fight that fight for the word hacker, but I don't give up that fight.
[17:58.070 --> 18:02.170]  I keep fighting for that. It doesn't always work, as I found out.
[18:03.890 --> 18:05.990]  So, yeah, and the other thing
[18:05.990 --> 18:09.930]  is, you know, like I said, we kind of hold Google to a different standard a little bit. We probably
[18:09.930 --> 18:13.530]  shouldn't. It may not be fair. But, you know, they
[18:14.710 --> 18:15.510]  have this
[18:19.830 --> 18:21.910]  hacker, and everybody's probably
[18:21.910 --> 18:25.950]  seen this joke before, right? They have on Google, in their translation
[18:25.950 --> 18:29.770]  services, a language called Hacksaw as one of their languages.
[18:30.170 --> 18:34.090]  Now, I mean, how are you going to have that on there? I mean, that's hypocritical to have
[18:34.090 --> 18:37.830]  that on there and promote, you know, like, first of all,
[18:37.830 --> 18:41.890]  it's at our expense with the whole LeetSpeak thing, and yeah, don't bring up my article
[18:41.890 --> 18:45.410]  from 2600. I don't want to hear that. But, you know,
[18:45.850 --> 18:48.110]  they've got stuff like this on there, and
[18:52.950 --> 18:56.230]  it's not just that. It's just the hypocrisy in general
[18:56.230 --> 19:00.130]  of Google that I've found I've had kind of a problem with. Another
[19:00.130 --> 19:04.210]  thing that they do on Google is, most of you probably know you can do
[19:04.210 --> 19:08.370]  define colon. You can find definitions on Google from different dictionaries,
[19:08.370 --> 19:12.230]  Wikipedia, stuff like that. You do a define of hacking on Google, and it
[19:12.230 --> 19:16.110]  brings up all these definitions, and they're mostly pretty accurate. So, if you go to Google and
[19:16.110 --> 19:20.090]  define hacker, Google gives you proper information. They have this
[19:22.230 --> 19:24.450]  Hacksaw translation service on there.
[19:24.510 --> 19:27.890]  So, you know, they're talking all this stuff. They've got the summer of code with this whole
[19:27.890 --> 19:32.170]  open source. We invented open source for God's sakes, you know?
[19:32.190 --> 19:36.270]  That's why they kind of come across like we're one of you. Well, they're not exactly.
[19:36.430 --> 19:40.030]  They're not at all, really. But, again, I'll back off.
[19:40.030 --> 19:44.230]  I told you I try to stay away from the rants on this. I don't know if I can pull that off.
[19:45.170 --> 19:47.630]  And this is the one that really made me break down.
[19:48.290 --> 19:52.410]  Well, first of all, I can't advertise the word hacking, but I think everybody's seen
[19:52.410 --> 19:56.370]  eBay and Amazon all the time. Everything that you search for, they can use the word
[19:56.370 --> 20:00.530]  hacking, but I can't. I get a warning letter saying that it's against their terms of service.
[20:00.530 --> 20:04.830]  But if you do a search for hacking radio, you'll say, buy hacker radio on ebay.com.
[20:04.830 --> 20:08.690]  You know, stuff like that. Buy used human hearts. Was that in the forums
[20:08.690 --> 20:12.690]  one time? How do you buy a used human heart? I don't want it if it's used.
[20:12.690 --> 20:14.290]  And how do you get a new one?
[20:16.930 --> 20:20.550]  Stem cell? Get controversial on here with the stem cell.
[20:20.570 --> 20:23.770]  Back away from that. But, yeah, it's...
[20:23.770 --> 20:28.950]  They have something called a keyword tool suggest. This is the thing that made me mad
[20:28.950 --> 20:32.710]  that I started arguing with them, trying to explain them what's going on. They have something called
[20:32.830 --> 20:36.750]  a keyword tool suggest. When you put in a keyword, what it does is it looks
[20:36.750 --> 20:40.930]  through to see what other keywords are related to it. So, like, if I did used cars, for example,
[20:40.930 --> 20:44.910]  it might pull up a list of makes. Or look what other people are advertising used cars
[20:44.910 --> 20:48.450]  and give you suggestions of what works for them or what gives them click-throughs.
[20:48.650 --> 20:53.010]  Well, I put in, you know, typical words, hacking, freaking, stuff like that. It comes back and gives me
[20:53.010 --> 20:57.410]  suggestions. Why don't you try security magazine? Why don't you hire...try freaking magazine?
[20:57.890 --> 21:00.950]  Hey, good idea. Thanks a lot, Google. I appreciate that. And I put those
[21:00.950 --> 21:04.530]  in there. Next day, cut off. Terms of service. You can't use those words.
[21:04.810 --> 21:09.030]  Why'd you tell me the words were there if you're not gonna let me use them? That's ridiculous.
[21:09.690 --> 21:12.990]  And that, honestly, that just, that kind of stupidity made me mad and that's why
[21:12.990 --> 21:16.730]  I actually sat down. That's the trigger that made me sit down and do this presentation.
[21:17.870 --> 21:21.310]  So, uh...huh?
[21:23.690 --> 21:25.070]  Well, they say you
[21:25.070 --> 21:28.990]  cannot contain it in the ad or link to sites that promote illegal
[21:28.990 --> 21:32.970]  activity. Again, I don't promote illegal activity, so...
[21:33.550 --> 21:36.870]  I promote hacking. Hacking is not necessarily
[21:36.870 --> 21:41.030]  illegal. And maybe we'll talk about that after the presentation. I can...definitely
[21:41.030 --> 21:44.810]  would be glad to go into a conversation about that. So, anyway,
[21:44.810 --> 21:48.310]  enough with the hypocrisy and the ranting and stuff. Let me move on to the tech stuff. What, sir?
[21:49.170 --> 21:53.170]  The DEF CON staff wants you guys to know that there's gonna be a spot to fed in Parthenon
[21:53.170 --> 21:54.950]  in five minutes.
[21:57.970 --> 22:01.390]  There's gonna be a spot to fed in Parthenon in five minutes.
[22:01.450 --> 22:02.590]  So, that's all.
[22:05.570 --> 22:06.710]  Alright, so, now
[22:06.710 --> 22:10.130]  let's get on with some of the tech stuff, some of the fun stuff. Enough with the ranting.
[22:10.850 --> 22:13.850]  Well, actually, real quickly, what you can do about it is
[22:14.730 --> 22:18.690]  you can reactivate your ads instantly. You can put your
[22:18.690 --> 22:22.590]  ads...first of all, ads are put into rotation immediately. That's an interesting thing to know.
[22:22.590 --> 22:26.750]  Anyone of you can go create an account, create an ad, bam, it's gonna be placed up within a couple
[22:26.750 --> 22:30.650]  minutes. A couple minutes. So, that's very important to notice. You can get an
[22:30.650 --> 22:34.970]  ad up there and it'll stay up for...until they find it. So, you can get ads up pretty quickly.
[22:34.970 --> 22:37.970]  I suspect they're gonna shut that down very, very quickly.
[22:39.170 --> 22:42.590]  The other thing, and this was...I laughed out loud when this happened to me.
[22:42.590 --> 22:46.790]  What they do is, if your ad does get banned, like, for example, my ad
[22:46.790 --> 22:50.690]  said, hacking magazine, radio show, the revolution will be
[22:50.690 --> 22:54.650]  digitized. That's all it said. And a link to binrev.com. And it's part of the presentation.
[22:54.650 --> 22:58.750]  I'm not pimping here. So, you know, I
[22:58.750 --> 23:02.870]  put that in there and they sent it back saying, you have the word hacking in the ad. It has nothing to do with what it linked to.
[23:02.870 --> 23:06.730]  It's what's in the ad. So, they didn't like the word hacking. So, I changed it to security.
[23:07.050 --> 23:10.670]  Okay, fine, whatever. Whatever will get through your system. And that went through.
[23:10.670 --> 23:14.730]  They approved that, no problem. So, it wasn't the content of the site exactly. It also probably
[23:14.730 --> 23:18.610]  depends on who's sitting at the keyboard and says, ah, I don't want to approve him or I don't, you know,
[23:18.610 --> 23:20.110]  however many people they do that.
[23:23.290 --> 23:26.630]  It looks like it's human interaction because sometimes it would be
[23:26.630 --> 23:30.530]  banned within an hour or two. Sometimes it would go for a week. So, that's kind of
[23:30.530 --> 23:34.690]  interesting. Yeah, that's a good question. I did, I get the feeling that it
[23:34.690 --> 23:38.530]  is done through human intervention. And again, and actually
[23:38.530 --> 23:42.710]  that's kind of another point is they claim that a human
[23:42.710 --> 23:46.650]  checks every ad before it goes up. But I know for a fact, I put ads in there,
[23:46.650 --> 23:51.010]  they're up within two or three minutes. Nobody checked that ad as soon as I put it up. They check it after the fact.
[23:51.010 --> 23:54.530]  They want you to get up and running quickly. Which again, that's probably going to change.
[23:54.530 --> 23:58.430]  So, enjoy it while it lasts. Might not be there when you get back from the weekend.
[24:00.310 --> 24:02.590]  So, yeah, so you modify your banned ad by making one
[24:02.590 --> 24:06.690]  small change. And then this is really funny and I'll give you the story
[24:06.690 --> 24:10.970]  of what happened to me. I kept going through this little game with them. Because I'm
[24:10.970 --> 24:14.410]  stubborn. People who know me know that I can be pretty stubborn sometimes.
[24:14.450 --> 24:18.550]  So, we went through this back and forth game where I changed it to security. Okay, and they
[24:18.550 --> 24:21.890]  approved it and went through the next day. Alright, well being the little
[24:22.790 --> 24:25.970]  butt that I am, watch my language, I went back in there
[24:25.970 --> 24:30.010]  and changed it back to hacking. And it went through for two or three days and then
[24:30.010 --> 24:33.650]  it got turned down again. So, I changed it back to security, no problem.
[24:33.830 --> 24:37.950]  Went back and changed it back to hacking again. We were playing through this game once in a while
[24:37.950 --> 24:41.950]  and not only that, but the individual keywords within the, that's the text of the ad
[24:41.950 --> 24:45.970]  itself, the individual keywords they would go through once in a while. Every time they can't ban
[24:45.970 --> 24:49.890]  the ad, they'd go ban a couple of the keywords. So, like they'd leave security working but they'd
[24:49.890 --> 24:53.870]  take out hacking or freaking or something like that. Alright, we want to play that game, we can play
[24:53.870 --> 24:57.830]  that game. So, I went in there, you delete those keywords out of there, when you try to add them back, it still
[24:57.830 --> 25:00.110]  says disable, they disable the individual keywords.
[25:01.890 --> 25:05.910]  It was, it blew my mind that this actually worked. If you delete the
[25:05.910 --> 25:09.930]  individual keywords and try to add them back, it doesn't work. But what you can do
[25:09.930 --> 25:13.850]  is go in there, select all of your keywords, they only ban two of them,
[25:13.850 --> 25:18.010]  it doesn't matter, select all 15 of them, copy and paste them, put them over into a text file.
[25:18.390 --> 25:22.090]  Delete it, save it with no keywords. Copy and paste it
[25:22.090 --> 25:24.930]  back in there, put those same 15 keywords back, you're up and running.
[25:25.950 --> 25:30.130]  I swear, I couldn't make that up, I could not make that up. You put them back in there,
[25:30.130 --> 25:33.990]  you're back up and running, every keyword, they did that to me one time, after
[25:33.990 --> 25:38.210]  this cat and mouse game, they deleted my, they banned my ad, they banned every
[25:38.210 --> 25:42.310]  individual keyword that I had created, I copied and pasted them all out,
[25:42.310 --> 25:46.050]  deleted the ad, recreated the ad, copied and pasted them all back in, back up and running
[25:46.050 --> 25:50.370]  within seconds. So, that is something else I assume they will probably
[25:50.370 --> 25:54.130]  take out. And I'll get some questions if I have time towards the end, because I want to
[25:54.130 --> 25:57.990]  make sure I cover everything here. So yeah,
[25:57.990 --> 26:01.930]  disabling the ads and the individual keywords and fixing them with cut and paste.
[26:02.590 --> 26:06.050]  And the daily limit I mentioned earlier,
[26:06.790 --> 26:10.030]  this is kind of, I'm not condoning this or saying anybody
[26:10.030 --> 26:14.090]  should do it, it's kind of sleazy, but you can click ads off people you
[26:14.090 --> 26:18.150]  don't like. If you're in the business world, it can get kind of cutthroat, people don't have morals in the business
[26:18.150 --> 26:21.990]  world. You want to go over, if you work for Ford and you want to go to click
[26:21.990 --> 26:25.990]  their Chevy's ads and make them pay for those clicks, when you run out and hit your daily
[26:25.990 --> 26:30.010]  limit, your ads stop showing. They do not show your ads anymore for that daily
[26:30.010 --> 26:34.030]  limit for the next 24 hour period. Now, there is kind of a caveat to that,
[26:34.030 --> 26:38.050]  they do have what they claim, click quality they call it, that's supposed
[26:38.050 --> 26:41.910]  to prevent fraud. Like basically, they check your IP address, I'm
[26:42.970 --> 26:45.930]  speculating of course, I don't work at Google, so I don't know what they do, but it seems
[26:45.930 --> 26:49.890]  like they probably will check your IP address, if you click 20 times in a row from that same IP, they probably know
[26:49.890 --> 26:53.930]  that that's invalid. I think everybody here probably knows
[26:53.930 --> 26:57.890]  what a proxy server is, I can't, I'm not going to go into a presentation of that, so I'm not
[26:57.890 --> 27:01.290]  going to go off on that tangent, but a proxy server, even that, I don't know
[27:02.510 --> 27:05.450]  not in an offensive way, but I don't know how smart Google is, they seem
[27:06.170 --> 27:09.850]  sometimes they do great stuff, sometimes they don't. So, they may be smart enough to even watch
[27:09.850 --> 27:14.190]  for proxy stuff, especially if it's repetitious, you keep hitting it over and over in a short period of time.
[27:14.410 --> 27:17.830]  All it takes is a very quick Perl script,
[27:17.830 --> 27:21.750]  go through proxies with a random timer, every 5 to 10 minutes, click
[27:22.490 --> 27:25.890]  that's going to be pretty hard to detect, it's going to be really hard to protect.
[27:26.690 --> 27:29.870]  So, and still, it's in 24 hour periods, so you can still get a lot
[27:29.870 --> 27:33.830]  of hits, they're going to end up paying a lot of money for it. So, again, don't
[27:33.830 --> 27:37.870]  do that. It can be done, but don't do that.
[27:37.870 --> 27:41.650]  And if you try to do it to me, let me remind you again, I have a limit, and it's really low, so
[27:41.650 --> 27:45.790]  you're not going to do too much. So, yeah, they
[27:46.330 --> 27:49.150]  again, they claim that they have humans that try to check for
[27:50.150 --> 27:53.850]  invalid clicks, you know, again, I don't know how accurate
[27:53.850 --> 27:58.090]  that can be, because, I mean, we all know how big Google is, and Google Adwords
[27:58.090 --> 28:01.950]  is the biggest advertising program on the global interweb, so
[28:01.950 --> 28:05.870]  I don't think they're going to be checking, they have too many customers and too many ads, I think that they can
[28:05.870 --> 28:09.850]  check all that stuff. So, yeah, so theoretically, again, since the
[28:09.850 --> 28:13.710]  ad goes up right away, you can put up an ad, watch me and my girlfriend
[28:13.710 --> 28:17.870]  have elite cyber sex, and they'll go up there, get people to your website for half an
[28:17.870 --> 28:21.730]  hour before they ever cancel it. I actually had an ad up that was like a week that had the word hacker in it
[28:21.730 --> 28:25.790]  that they never got around to doing, so it's hit and miss how often they'll leave stuff up, but you can
[28:25.790 --> 28:29.350]  put up just about anything for a short time period.
[28:31.410 --> 28:32.410]  And you can
[28:33.530 --> 28:36.450]  you can use words that are invalid because of that, so I think that's
[28:36.450 --> 28:40.330]  pretty much self-explanatory, but you already have to babysit it. Well, again, they're
[28:40.330 --> 28:44.350]  changing this. I felt I had to babysit it every day anyway, so I was going in and making all kinds of
[28:44.350 --> 28:48.390]  keywords just to mess with people, just to do funny stuff, and that's how I found out, we're going to get into
[28:48.390 --> 28:52.250]  some of the screenshots and some of the actual techniques now that I found some of the stuff. It was mostly just
[28:52.250 --> 28:56.690]  playing, just to see what I could do. I have to go in and babysit anyway, I might as well go in there. So,
[28:56.690 --> 29:00.590]  we'll move on to some of the tricks, and this is one of my favorite ones,
[29:00.590 --> 29:04.210]  and this is the kind of stuff, a couple of these things we're going to talk about now is
[29:04.210 --> 29:08.670]  some of the things that they charge you a lot of money to optimize to get your ads to the top.
[29:08.670 --> 29:12.690]  It's really a lot of it comes down to click-through ratio and using the proper keywords.
[29:12.990 --> 29:16.870]  One trick I found, and it was purely by accident,
[29:17.270 --> 29:20.550]  mesothelioma. Can somebody spell mesothelioma
[29:20.550 --> 29:24.530]  for me? I couldn't spell mesothelioma, so I put it in there
[29:24.530 --> 29:28.590]  because I wanted to see what the actual top bid was at that time. I just wanted to see if it
[29:28.590 --> 29:31.470]  really was $40, you know. And it was, it was $40.
[29:33.010 --> 29:36.610]  I put it in there, but I spelled it wrong. So, when I went in there and was searching for
[29:36.610 --> 29:40.770]  my ad, I'm like, why are there only like two ads? Because this is a huge thing, there's usually pages
[29:40.770 --> 29:44.910]  of ads. I'm like, oh, I spelled it wrong. And then I went, wait a minute.
[29:44.910 --> 29:48.690]  I wonder what happens if I intentionally misspell things. I'm kind of backing away from
[29:48.690 --> 29:52.710]  the mic there. What happens if I intentionally misspell things? This is a great technique.
[29:52.710 --> 29:56.510]  People misspell things all the time on Google. And you know when you do this, Google
[29:56.510 --> 30:00.670]  at the top says, did you mean to say mesothelioma with the proper spelling? It doesn't matter.
[30:00.670 --> 30:04.590]  It's too late. The ad has been delivered at that point. So, I put in the incorrect
[30:05.670 --> 30:08.350]  spelling of mesothelioma, and you'll see
[30:08.350 --> 30:12.630]  that this $40 ad comes up. Now, there's a couple other people that
[30:12.630 --> 30:16.670]  might have legitimately misspelled, but for five cents on a $40
[30:16.670 --> 30:20.430]  keyword, right there, I got this ad cheap. All I did was
[30:20.430 --> 30:24.510]  misspell a word, and I saved $39.95. So, it's, it
[30:24.510 --> 30:28.030]  works. I don't...
[30:28.810 --> 30:31.570]  So, there's proof. I don't make this stuff up.
[30:32.890 --> 30:35.410]  I told you this would be fun. There's some of this good stuff.
[30:37.170 --> 30:40.890]  Let's see. Oh, and actually, for logical purposes,
[30:40.890 --> 30:44.450]  if you just want to play with that and track it, I would make a separate ad group, like we
[30:44.450 --> 30:48.610]  talked about earlier, a logical unit with misspellings to see how they perform. You might be really
[30:48.610 --> 30:52.590]  really surprised. Because people are obviously looking for that particular thing, and if you're the only ad
[30:52.590 --> 30:56.390]  they see, you might actually get a higher click-through rate on misspellings, which is kind of ironic.
[30:57.270 --> 31:00.630]  Another thing is to use proper names. This is kind of
[31:00.630 --> 31:04.630]  most people probably would have thought about this, but like if you work for Coke, and you want to get
[31:04.630 --> 31:08.550]  somebody who's searching for Pepsi to see your Coke ad, you know, use Pepsi's name. There's copyright
[31:08.550 --> 31:12.550]  issues here, and I think there's been cases in the past. There's nothing that stops
[31:12.550 --> 31:15.490]  you from doing it. If you work for Ford, and you want somebody searching for a Chevy
[31:16.590 --> 31:20.550]  S10, and you want to put in an ad for your Ford truck or whatever,
[31:20.550 --> 31:24.430]  or something like that, you use those opposite keywords to get the people to see your ad.
[31:24.530 --> 31:27.810]  So, keep that in mind that you can use stuff. And this example,
[31:27.810 --> 31:32.370]  this is not a very good example of that, but just to prove the point, I put in
[31:32.370 --> 31:36.630]  America Online as my keyword, and you see, owned by the DDP ad comes up.
[31:36.710 --> 31:40.630]  Now, I really, no offense to any AOL users,
[31:40.630 --> 31:44.630]  but I really don't want the AOL users, so I just put that out just as a proof of concept
[31:44.630 --> 31:48.650]  that this actually works. Again, no offense, but just to prove
[31:48.650 --> 31:52.470]  that it works. And I actually noticed this in the hotel room
[31:52.470 --> 31:56.530]  night before last, and I found this funny. I hope you guys too. Totally
[31:56.530 --> 32:00.670]  by coincidence. I did this as a proof of concept, just for the fun of it. And you see my ad over
[32:00.670 --> 32:04.690]  on the side. The one above it, again, eBay. They get every keyword, no matter what.
[32:04.690 --> 32:08.610]  But notice what the AOL at the top, the sponsored link, they're paying
[32:08.610 --> 32:12.790]  for that. If you click through that, AOL pays for it. But look at the first actual
[32:12.790 --> 32:16.770]  search result. It's AOL. Why are you paying
[32:16.770 --> 32:21.610]  to get the top spot and being charged for a click through when you're already number one on the list?
[32:21.810 --> 32:24.890]  Where's the logic in that? So make sure you always click on the one
[32:24.890 --> 32:28.930]  that charges them. I'm sorry, I didn't say that.
[32:29.690 --> 32:32.490]  I did not say that. Make sure you don't.
[32:32.490 --> 32:34.110]  I misspoke, I'm sorry.
[32:37.450 --> 32:38.610]  What else?
[32:40.990 --> 32:44.870]  For example, I used the name of another hacking
[32:44.870 --> 32:48.950]  magazine to trigger ads for our hacking magazine, which I have a couple I'll give away
[32:48.950 --> 32:52.370]  at the end of the talk as well, and some stickers to give away if you want to come up afterwards.
[32:54.090 --> 32:56.490]  And again, AOL, so I mentioned that. So some
[32:56.490 --> 33:00.770]  other tricks. Use Google hacking techniques. Now this is kind of funny. Somebody
[33:00.770 --> 33:04.750]  might want to go over to Johnny Long 7 o'clock tomorrow
[33:04.750 --> 33:08.810]  and let him know that this can happen. But basically you can use Google hacking techniques
[33:08.810 --> 33:12.810]  to catch people that are Google hacking. Google AdWords techniques, excuse me.
[33:12.810 --> 33:17.050]  All it's really doing is searching for a literal string. And I just picked one example
[33:17.190 --> 33:20.550]  a very common one, finding index of password to find password files.
[33:20.550 --> 33:24.770]  And notice that it triggered my ad over there. You can actually trigger people and find
[33:24.770 --> 33:28.510]  people that are Google hacking. If they put that in and try to find it, I just triggered an ad for them.
[33:28.510 --> 33:32.910]  So you can actually catch people, especially, and again the new site targeted
[33:32.910 --> 33:36.770]  thing is very new, but if you start site targeting it, you can see who's attacking
[33:36.770 --> 33:41.110]  what site with what Google hacking techniques, which is kind of an interesting combination.
[33:41.110 --> 33:45.270]  So it'll be interesting to see how they, if they do anything about that.
[33:47.770 --> 33:49.110]  Also, let's see...
[33:50.130 --> 33:53.150]  Oh, it's actually, if you go back, if you think about
[33:53.150 --> 33:57.170]  this is just, again, a made up example, but I came up with the idea of, you know, wouldn't it
[33:57.170 --> 34:01.230]  be funny if you put an ad over there to like a coupon code or something on your
[34:01.230 --> 34:05.190]  site or a secret URL that you don't publish anywhere else that you
[34:05.190 --> 34:09.110]  know and basically set up a honeypot using Google. Anybody that's
[34:09.110 --> 34:13.370]  hacking Google, anybody that comes to that site, you know they got there because they were trying to hack your site.
[34:13.390 --> 34:17.170]  You know they got this coupon code because they were out trying to get into your site and you gave them this coupon.
[34:17.170 --> 34:21.270]  So you really set people up and really draw them in. Entrapment, I guess is the word.
[34:22.110 --> 34:24.350]  It's honeypot, honeypot is different.
[34:25.210 --> 34:28.930]  So, yeah, and yeah, so and another
[34:28.930 --> 34:32.930]  the next thing is data hiding, which is
[34:33.790 --> 34:37.270]  could be a whole presentation in and of itself. I'm just gonna skim over
[34:37.270 --> 34:41.330]  it. It could be a very in-depth topic, but it can be as simple as passing
[34:41.710 --> 34:44.850]  a hidden message to somebody. Giving them the keyword to search for
[34:44.850 --> 34:49.290]  on Google and I mean if you see that's a big 80
[34:49.290 --> 34:53.450]  I don't know how many characters. This is a message for DEF CON attendees only approved.
[34:53.590 --> 34:57.190]  I didn't get any hits because, you know, that's not a keyword that's not out there somewhere
[34:57.190 --> 35:01.430]  but it did trigger your ad. You can use any gibberish, any kind of string, any characters
[35:01.430 --> 35:05.290]  that you want up there and deliver a hidden message. The only person that's gonna know it's, I mean who's gonna
[35:05.290 --> 35:09.270]  accidentally type in this message is for DEF CON attendees only as proof of concept of
[35:09.270 --> 35:13.250]  whatever I wrote there. Not many people. So you can pass just plain text hidden
[35:13.250 --> 35:17.790]  messages that way, which is kind of an interesting thing. Who knows if people are already doing that?
[35:17.830 --> 35:21.370]  You know, I'm not gonna, I don't want to use the T word at a hacking convention
[35:21.370 --> 35:25.710]  but anyway, terrorist. Who knows what they could be doing?
[35:27.150 --> 35:29.310]  Anyway, come on, some of you didn't know what I meant
[35:29.310 --> 35:33.270]  by T word. I had to, um, so yeah, passing messages
[35:33.270 --> 35:37.130]  right under the public's nose. Again, unless they know what they're looking for, they're not gonna
[35:37.130 --> 35:41.290]  accidentally stumble. So it's fairly safe. Again, you probably don't want to put passwords or anything
[35:41.290 --> 35:45.390]  credit card numbers or anything stupid like that on it. But if you wanted to pass secret messages to people
[35:47.230 --> 35:49.350]  keep in mind it's an 80 character limit to the keywords
[35:49.350 --> 35:53.330]  so you might be able to put maybe a public key or something like that in there or
[35:53.890 --> 35:57.470]  it could be a password with no URL. The person has to know the URL ahead of time
[35:57.470 --> 36:01.750]  and if you change the password they just always know to go look here, for example, things like that.
[36:03.150 --> 36:05.270]  Or just any kind of secret key.
[36:05.690 --> 36:09.570]  I'll leave the application to you. But there's a lot of stuff, I mean I'm sure
[36:09.570 --> 36:13.950]  some of you can already kind of think about it, but not that I condone this word
[36:13.950 --> 36:17.290]  or zero day announcements
[36:18.710 --> 36:20.550]  what's that? Juarez?
[36:23.970 --> 36:25.790]  I'm just saying it could be done. Once again
[36:25.790 --> 36:29.010]  don't do that. Just saying it's possible.
[36:29.510 --> 36:33.510]  And yes, if anybody wants to memorize that real quick
[36:33.510 --> 36:37.210]  before we go on to the next slide, there is a hidden message on that URL.
[36:37.590 --> 36:38.510]  Just for you.
[36:40.630 --> 36:43.990]  Again, data hiding. You can't talk about data hiding really without steganography.
[36:44.650 --> 36:47.970]  Again, like I said earlier, whole presentations could be done on that.
[36:49.050 --> 36:52.290]  Basically, I'll just read the Wikipedia definition and I think
[36:53.070 --> 36:55.830]  a lot of you already know it and I don't want to talk down to people, but it basically
[36:55.830 --> 36:59.810]  according to Wikipedia, steganography is the art and science of writing hidden messages
[36:59.810 --> 37:03.610]  in such a way that no one apart from the intended recipient knows of the existence
[37:03.610 --> 37:07.850]  of the message. Generally, when people think steganography, they think
[37:07.850 --> 37:11.850]  hiding stuff in an image or a graphic. That's not necessarily the case. I just want to throw
[37:11.850 --> 37:15.830]  that out there. It can be hidden in text, hidden in images, hidden in music files,
[37:15.830 --> 37:20.230]  deals with least significant bits and how you can take advantage. But again, that's a whole other topic.
[37:20.230 --> 37:24.410]  So just the simple fact that these, you know, as far as you know, those are images.
[37:24.410 --> 37:28.930]  As far as Google knows, those are images, but they're not just images.
[37:28.930 --> 37:32.410]  I actually did hide them in there. Yes, they're on Google. Yes, Google
[37:32.410 --> 37:36.350]  accepted them. They do not know that there's hidden messages that I've used steganography. How could they?
[37:36.350 --> 37:40.730]  Because I actually can password protect the information inside of it as well.
[37:40.730 --> 37:44.390]  And this is a tool called Puff 1.01.
[37:44.790 --> 37:48.390]  There's tons of steganography tools out there you can try. This one was quick and easy. I grabbed it
[37:48.390 --> 37:52.450]  and allowed me to password protect it. And you can see that that is pulling
[37:53.370 --> 37:56.230]  stego.txt, a file that I created and inserted. And if you
[37:56.630 --> 38:00.470]  press the key, you'll see that basically it's just a little text file that I put inside of the image
[38:00.470 --> 38:04.350]  that says DDP owns Google AdWords. So once again,
[38:04.350 --> 38:08.510]  it works. Also, just, I don't know if anybody
[38:08.510 --> 38:12.490]  else is the level of geek that I am, but yes, if you count,
[38:12.490 --> 38:16.430]  you see it says 24 bytes. If you count the letters, and a blank space
[38:16.430 --> 38:20.450]  is a byte, for those of you, there are 24 there. So that is, I didn't fake the picture in
[38:20.450 --> 38:23.470]  there, but anyway, there's your proof that kind of a check's on there, if you will.
[38:24.810 --> 38:27.790]  So, oh, the only other thing is there is a limit to 50k
[38:28.190 --> 38:32.350]  for the image size. So keep that in mind. You can't, you know, upload an ISO or anything
[38:32.350 --> 38:36.950]  like that hidden inside of a graphic or anything if you're thinking all crazy like...
[38:36.950 --> 38:38.610]  Well, a small ISO maybe.
[38:41.250 --> 38:43.790]  Let's see. Yeah, and
[38:44.310 --> 38:48.330]  again, I just put in text. You can actually put another image in. You can put in any
[38:48.330 --> 38:52.330]  binary file. You can put in a URL to a hidden site once again. Maybe put
[38:52.330 --> 38:56.210]  the URL to your hidden site using steganography into an image
[38:56.210 --> 39:00.330]  and then the password using that other hidden keyword. And all you got to do is email the person
[39:00.330 --> 39:04.070]  with those two things. They know to Google for the two of them. They know how to pull them out. You can
[39:04.070 --> 39:08.530]  absolutely, without a doubt, pass all kinds of hidden information
[39:08.530 --> 39:12.510]  through Google, the biggest site, again, on the entire
[39:12.510 --> 39:16.490]  global interweb. You can pass stuff under the entire public's nose.
[39:16.490 --> 39:20.350]  Millions and billions of people and they'll never see it. It's really, really
[39:20.350 --> 39:24.070]  kind of scary. It's really, again, application of that
[39:24.070 --> 39:25.730]  I'll leave to your imagination.
[39:27.290 --> 39:32.070]  This is probably my favorite slide. This one made me laugh once again.
[39:32.790 --> 39:36.330]  Misleading people. Misleading people. DEFCON
[39:36.330 --> 39:40.690]  official site. You see the ad that I put there? Don't tackle me or anything. It's just a
[39:40.690 --> 39:44.090]  joke. Don't send security up here after me or anything. DEFCON official site.
[39:44.090 --> 39:48.130]  I swear, on the DEFCON official site. It even says DEFCON.com
[39:48.530 --> 39:51.550]  on the ad. You see there on the right. On the left hand side, you see
[39:52.130 --> 39:56.230]  and this is just built in. They just give you this. This is not like a big hack. They give you this.
[39:56.230 --> 40:00.210]  The display URL and the destination URL. And you see the one string I have
[40:00.210 --> 40:03.850]  DEFCON official site. And when you click on it, it doesn't take you to DEFCON
[40:03.850 --> 40:08.670]  it takes you to StangDog.com. So, this example is funny.
[40:09.210 --> 40:12.270]  I think everybody in here also knows what the word phishing is.
[40:13.030 --> 40:16.330]  How dangerous would this be to somebody who wants to go phishing
[40:16.870 --> 40:19.510]  on Google? I could have easily made
[40:20.130 --> 40:24.330]  and again, this proves that it's a joke. Keep security back. This proves that
[40:24.330 --> 40:28.170]  it's a joke, but it could have very easily, I could very easily have ripped DEFCON's page
[40:28.610 --> 40:32.170]  put it up here. People wouldn't notice the URL actually says StangDog.com or
[40:32.690 --> 40:36.130]  DEFCON with two N's dot org if I registered something close to it or something like that.
[40:36.130 --> 40:40.230]  Made it look exactly the same, but when you submit to buy
[40:40.230 --> 40:43.250]  DEFCON doesn't sell anything, this is a bad example, but I could put, I don't know
[40:44.730 --> 40:47.990]  Citibank, yes, and prompt them for their credit card number, password
[40:49.090 --> 40:52.170]  just any site that sells anything, you know, have them click through
[40:52.170 --> 40:55.870]  buy something, I get all that information. It really is incredibly
[40:56.430 --> 41:00.250]  dangerous. The potential for fraud for this is horrible and this is something
[41:00.250 --> 41:03.890]  that I hope Google, I don't know what the, yeah, there's something they can do about it. They can not
[41:03.890 --> 41:08.070]  give that option. This is something that Google really absolutely needs to address because
[41:08.070 --> 41:11.390]  this could be devastating to a lot of people because
[41:11.950 --> 41:16.070]  everybody in this room, yeah, okay, everybody
[41:16.070 --> 41:20.470]  in this room wouldn't fall for phishing emails. I'm sure nobody's ever fallen for one of those.
[41:20.550 --> 41:24.090]  But a lot of people do. And if they fall for the emails with the misspellings and
[41:24.090 --> 41:28.230]  the all caps letters and they're sending money, they're going to fall for this. I mean, come on
[41:28.230 --> 41:32.150]  this is even more effective because they trust Google. So actually that trust is working
[41:32.150 --> 41:35.970]  against them. So, yeah, so
[41:35.970 --> 41:39.770]  credit cards stolen, our email is, our email system is
[41:39.770 --> 41:43.830]  undergoing maintenance. Please enter your password. Again, possibilities of that are endless.
[41:44.290 --> 41:47.510]  And again, you're phishing in the largest pond on the global interweb.
[41:47.670 --> 41:52.050]  So, that's really about it. You know, my final parting shot
[41:52.050 --> 41:56.070]  at Google because of this was, you know, never piss off a hacker. Really. And that's
[41:56.070 --> 41:59.330]  what they did. I felt kind of offended. I tried to talk to them like adults. They kept
[41:59.970 --> 42:04.010]  I, this is my pet peeve. Don't keep cutting, pasting the same terms of service
[42:04.010 --> 42:08.130]  back to me every time. I got it the first time. I'm trying to explain to you
[42:08.130 --> 42:12.130]  that I don't exactly fall into hacking and cracking. You need to check this out
[42:12.130 --> 42:16.090]  Mr. Dog because this is our terms of service. I got it the first time. Don't send
[42:16.090 --> 42:20.150]  it to me again. Will you please, do you realize that you do this, this, and this? And eBay is allowed to use
[42:20.150 --> 42:24.150]  it. Please note, our terms of service, section three. I saw it the first
[42:24.150 --> 42:28.210]  three times. Stop sending it. So, made me mad. Never piss off a hacker. You can see
[42:28.210 --> 42:32.130]  you know, and I've already basically talked about this, but this is a step through. There's the ad
[42:32.130 --> 42:35.990]  that you create. There's the actual keywords. You put it in quotes. You can use Google hacking
[42:35.990 --> 42:40.110]  techniques, by the way. I don't know if I mentioned that earlier. Putting things in quotes. Using
[42:40.110 --> 42:44.290]  plus, minus signs. If you don't want, like for example, 2600
[42:44.290 --> 42:47.930]  magazine. I don't want 2600, Atari 2600
[42:47.930 --> 42:52.290]  hits, people getting my hits because then that lowers my click-through ratio. You put a minus in front of the 2600
[42:52.290 --> 42:56.130]  or put a minus in front of games or minus in front of Atari to eliminate those.
[42:56.130 --> 42:59.870]  You can use Google hacking techniques in this. So, keep that in mind. That's very handy.
[42:59.870 --> 43:04.070]  And that's how you, for those of you who are thinking about this from a business standpoint,
[43:04.070 --> 43:07.810]  use negative keywords and you can isolate and start targeting your hits
[43:07.810 --> 43:11.670]  and increase your click-through ratio. So, that's a good thing to keep in mind. So, yeah.
[43:11.670 --> 43:15.670]  That's the ad itself. And these next couple slides go pretty self-explanatory.
[43:15.670 --> 43:19.710]  When I search for Google really sucks. If you see the logo there, you know what day. Somebody wants to
[43:19.710 --> 43:23.670]  do some research that I took the screenshot to. And basically
[43:24.090 --> 43:27.910]  up comes the ad. So, you know, this is, again, this is
[43:27.910 --> 43:31.430]  me being silly. It's kind of a fun presentation. It just says Google owns, you know,
[43:31.430 --> 43:34.730]  DDP owns AdWords or whatever I put. I don't even remember. But
[43:35.690 --> 43:39.870]  not only is this instantly embarrassing for Google, but it could be
[43:39.870 --> 43:43.470]  for anybody. And I'll refer back to, like, I'm sure a lot of people here remember
[43:44.090 --> 43:48.010]  maybe a lot of people here remember the FordSucks.com controversy and stuff like that.
[43:48.010 --> 43:51.850]  This is the new way to protest. This is how you're going to be able to go out there
[43:51.850 --> 43:55.870]  and put, fill in the blank sucks. And put an ad that you're going to see to millions
[43:55.870 --> 43:59.910]  and millions of people. Put a minimum daily limit on it
[43:59.910 --> 44:03.850]  of a nickel so that nobody will click through it or whatever, you know, so you don't get charged for it. But you can
[44:03.850 --> 44:07.930]  put that protest up and get a lot more people seeing your site than you would if you just
[44:07.930 --> 44:12.330]  registered the site, you know, and put it out there. So this is really the new way to protest.
[44:13.510 --> 44:16.090]  I was thinking, I don't know how much you could get in that little space,
[44:16.090 --> 44:20.290]  but remember the DECSS, where they wouldn't allow you to share that code,
[44:20.290 --> 44:24.250]  that information. Go out there and put it on Google. I mean, you can't
[44:24.250 --> 44:28.170]  stop. I have a phrase I use on the show a lot that I'm not going to do up here,
[44:28.170 --> 44:31.610]  but you can't put stuff back in the horse, is my saying I say on the show a lot.
[44:31.830 --> 44:36.130]  Once it's out there, you know, and you can use Google to get it everywhere. I mean, this huge
[44:36.130 --> 44:39.850]  search engine, take advantage of stuff like that. I mean,
[44:39.850 --> 44:43.670]  I can say that. That's safe, right? Take advantage of Google for what they give you. There's nothing wrong with saying that.
[44:43.670 --> 44:45.530]  Just not in a negative way.
[44:45.550 --> 44:52.290]  Oh yeah, and this is actually, I added this
[44:52.290 --> 44:55.830]  kind of at the last minute. I was thinking about this too. Earlier I mentioned you could use
[44:57.050 --> 45:00.450]  keywords from your competitor to put ads, you know,
[45:00.450 --> 45:04.370]  to draw people away from that topic. You can draw them away
[45:04.370 --> 45:08.290]  from that topic. Well, now with this new site targeted, and because I haven't had time
[45:08.290 --> 45:12.090]  to play with this yet, unfortunately, with this new site targeted stuff, you can actually
[45:12.510 --> 45:16.110]  target that site with that ad. So, if cope.com uses
[45:16.590 --> 45:20.090]  ads provided by Google, which they probably don't, well, I don't know, they might.
[45:20.090 --> 45:24.150]  If they did, I can start giving them ads as from the company Pepsi or any
[45:24.150 --> 45:28.090]  other, again, made up example, but pick whatever your competitor is of your company
[45:28.090 --> 45:32.070]  wherever you work, and you want to, advertising company, and you want to get ads
[45:32.070 --> 45:36.130]  from the other person, and they use AdWords, site target your ads over to their site, try
[45:36.130 --> 45:40.090]  to pull people away. We are cheaper than these guys. Come to us, you know, and give
[45:40.090 --> 45:44.370]  them the URL. So, that's kind of a dangerous thing as well. Or
[45:44.890 --> 45:48.190]  this site is fake, don't give them your information. You could be real mean about
[45:48.190 --> 45:51.490]  the whole thing. Give them a link to the GoatSea guy, somebody mentioned him.
[45:52.210 --> 45:56.150]  Which, so, and I'm hoping to make it through the weekend without seeing that, please, somebody
[45:56.150 --> 45:59.070]  help me, please, or the weight lifter.
[46:00.910 --> 46:03.450]  Yeah! Score!
[46:05.050 --> 46:08.250]  So, anyway, yeah, that's pretty much it, just
[46:08.250 --> 46:12.150]  some parting ideas, again, that the ad can actually carry
[46:12.150 --> 46:15.570]  more information, whether it's URL, whether it's
[46:16.030 --> 46:19.550]  steganography I talked about earlier. This is something interesting I just found
[46:19.550 --> 46:23.770]  on July 4th, makes sense. At the top, on special holidays,
[46:23.770 --> 46:27.530]  you can click on that link, and like for July 4th, I think it was, I have it written down,
[46:27.530 --> 46:31.350]  it is Independence Day
[46:31.850 --> 46:35.710]  2005. When you click on the image, a lot of people click on that.
[46:36.190 --> 46:39.690]  If you own a fireworks company, put that
[46:39.690 --> 46:43.730]  as your keyword, on that one day, everybody that clicks on that is going to get your ad on there.
[46:43.730 --> 46:48.050]  You sell American flags or something like that on a
[46:48.050 --> 46:52.010]  patriotic day. You're having a big Easter sale or something like that. Whatever the keyword
[46:52.010 --> 46:56.050]  that Google uses for that day, you're going to have a 24-hour huge traffic that you're going to drive
[46:56.050 --> 47:00.230]  people in. That's probably something that larger businesses would take advantage of because they want
[47:00.230 --> 47:03.890]  to get as much publicity as they can for it, but that's another kind of interesting technique.
[47:03.890 --> 47:07.850]  It wouldn't make sense for me to do that again for my magazine on that, I'm going to get a bunch of hits of people
[47:07.850 --> 47:11.730]  who aren't interested in it. But if you own a big store like Amazon and they wanted to draw people in, that would be
[47:11.790 --> 47:16.270]  a good technique for them to use, so make some mad money that way.
[47:16.830 --> 47:18.530]  And yeah, Google offers
[47:20.050 --> 47:23.990]  ads and text or images, like I said earlier for the steganography.
[47:23.990 --> 47:27.710]  And also one last little thing, and this is kind of going into AdSense, which is
[47:27.710 --> 47:31.590]  not what this is about, but because they're related, I just want to mention
[47:31.590 --> 47:35.670]  that you can, your ads are targeted
[47:35.670 --> 47:39.870]  to whatever the topic of your site is, whatever keywords are used
[47:39.870 --> 47:43.770]  for it, so if you wanted to make, you can, theoretically you can make a page
[47:43.770 --> 47:47.730]  on mesothelioma, write an article about it, keywords with it, and then put
[47:47.730 --> 47:52.010]  Google AdSense on it. And it's going to get hit by Google, and if somebody clicks through it, you're going to get a
[47:52.010 --> 47:55.930]  percentage of that 40 bucks when they click through. You can get as high as 50 or even higher percentage.
[47:55.930 --> 48:00.070]  You can make 20 bucks. And it's very, very sleazy, right there, don't
[48:00.070 --> 48:04.010]  I definitely don't want to do that. I really don't want you guys to do that, but I thought that was
[48:04.010 --> 48:07.810]  interesting enough to mention. You can make, at least not for mesothelioma, you know, that's something
[48:07.810 --> 48:11.830]  serious that people really might be looking for help, so I'd hate to see somebody take advantage of that.
[48:11.830 --> 48:15.630]  But if you wanted to make it for some site you wanted to protest or some site you
[48:15.630 --> 48:19.930]  really had issues with or something like that wasn't, I guess it's all going to be hurting somebody
[48:19.930 --> 48:23.790]  somehow, but I'll just back away from that topic, but you can see what I'm talking about.
[48:23.810 --> 48:27.750]  You can make them click through your site, make it whatever topic, and you can get
[48:27.750 --> 48:31.990]  the money back from that. And I'll just leave this as an open-ended, what if
[48:32.730 --> 48:35.830]  you put your own ads on a
[48:35.830 --> 48:39.770]  friend's site and they click through it or wrote that script we talked about that
[48:39.770 --> 48:43.730]  automatically clicks through and pays you every time they click through, the potential
[48:43.730 --> 48:47.830]  is there for abuse of that as well. So that's it. You can game AdSense
[48:48.430 --> 48:51.970]  by using AdWords, as I just described, and that's it for me.
[48:51.970 --> 48:54.830]  I don't know if we have enough time for questions or
[48:55.530 --> 49:00.190]  five minutes. If anybody does, a couple of people have questions. Before I go, if I may...
[49:02.030 --> 49:03.070]  Thank you.
[49:04.070 --> 49:07.190]  Before you all take out, I do want to send some thanks. Of course,
[49:07.190 --> 49:11.250]  thanks to the DDP, all these guys have helped me do a lot of this research. To Decoder,
[49:11.250 --> 49:14.810]  if anybody knows Decoder, I'm still thinking about you, Decoder, and
[49:14.810 --> 49:19.070]  I know you might not see this for a long time, but I'm still looking out for you.
[49:19.210 --> 49:23.290]  Everybody at binrev.com, there's the pimp for the site I was looking for earlier, binrev.com
[49:23.290 --> 49:27.250]  is the main site. Stankdog.com, my personal, if you want to go check any of those out.
[49:27.250 --> 49:31.110]  To DC305, my local DEF CON meeting, FL2600, my
[49:31.690 --> 49:35.510]  binrev561 meeting, some of which are here today. And again,
[49:35.510 --> 49:39.250]  required by Google, I am not associated. Google AdWords is a trademark
[49:39.250 --> 49:43.090]  of Google Incorporated. I am not affiliated with them. Please don't sue me. Does anybody
[49:43.090 --> 49:47.370]  here work for Google? Like you'd admit it anyway. So, that's it. Don't be evil.
[49:47.370 --> 49:48.290]  Thank you very much.