00:00:00.000-->00:00:04.958 >>Uh, topic of this talk is opt out or deauth trying. It's going to be anti-uh, tracking, bots, 00:00:04.958-->00:00:09.375 radios, and keystroke injection. It's going to be throwing off brick and mortar stores. Um, the 00:00:09.375-->00:00:14.250 ways that they're tracking you. Um, everything from billboards, um down to the the basic uh, 00:00:14.250-->00:00:19.500 analytics and information that Google collects when you do searches and things of that 00:00:19.500-->00:00:24.500 nature. I'll have the slides in one second here. [mic bump] Sweet. I will get this playing 00:00:44.167-->00:00:49.167 here. [chuckles] Ah, there we go. Awesome, now you got some visuals to go along with it. So, 00:00:55.000-->00:00:59.458 as I said my name is Weston Hecker. Feel free to follow me on Twitter. I do a lot uh 00:00:59.458-->00:01:02.750 research during the year and uh I love helping people with projects and just security 00:01:02.750-->00:01:06.875 research in general. I'm going to go into a little bit of detail we’ll make it a little 00:01:06.875-->00:01:11.542 bit quick here. Um, about myself, I’m 32, work for NCR live in North Dakota. Any other 00:01:11.542-->00:01:15.333 North Dakotans? No OK. [laughs] [audience laughs] There's probably six of us >>WAHOO >>ah 00:01:15.333-->00:01:20.500 yea, OK There's one or two of them. Uh, let's look ahead. This is my fourth year in a row 00:01:20.500-->00:01:25.083 speaking at DEFCON, uh, spoke at Hope, um, Black Hat last year, lots of conferences, so I love 00:01:25.083-->00:01:28.125 getting out meeting the community. That's the reason I do these talks is to meet people 00:01:28.125-->00:01:32.792 like you guys. So, and I have been doing uh 12 years pen testing professionally and uh 13 00:01:32.792-->00:01:38.250 years of research programming. Things along that and uh, I did a lot of ATM car hacks, um 00:01:38.250-->00:01:42.083 several IOT projects going on right now. Uh, reverse engineering malware things like 00:01:42.083-->00:01:46.792 that. Um, I'm going to be doing an uh, cool uh, attack on vehicle the, does anybody have a 00:01:46.792-->00:01:50.333 push button start car? You should definitely come down to the car hacking village. I'm 00:01:50.333-->00:01:54.875 going to demo um, uh, how to stop the relay attacks where pe..it it's a bas- basically 00:01:54.875-->00:01:59.542 people are using software to find radios to actually steal vehicles. So, I'm going to go 00:01:59.542-->00:02:02.125 into how the actual attack works, then I'm going to go into uh, some two factor 00:02:02.125-->00:02:05.917 authentication that I added that's built on a 12 dollar arduino project. So it's very 00:02:05.917-->00:02:11.583 cool. And uh a little bit about this research and what led to it. Uh, so as you can see 00:02:11.583-->00:02:16.500 Microsoft, uh, Window 7, end of life was all announced and uh, I mainly use Linux uh like a 00:02:16.500-->00:02:20.417 majority of the people here probably do, but I am forced uh to use uh, Windows for some 00:02:20.417-->00:02:25.417 applications and I had a quick uh, question I called one of my buddies and I'm sure everybody 00:02:25.417-->00:02:30.125 has that buddy that you call them for that simple about uh, um a some pr- uh some concerns 00:02:30.125-->00:02:35.250 and things like that and they'll uh talk your ear off about chemtrails for the next hour and 00:02:35.250-->00:02:39.833 a half. So, [laughter]. He's a very, very paranoid guy. Um, he's usually right though. Uh, 00:02:39.833-->00:02:43.458 he's uh, added uh validity several times when I've talked to him. So, and he's helped with 00:02:43.458-->00:02:49.333 uh tons of my research especially my uh, cell phone hacking one I did in uh, DEF CON 00:02:49.333-->00:02:53.542 22. So, which, yeah that's basically I did as research I started uh, installing Windows 00:02:53.542-->00:02:59.292 10 in most of my machines. And, uh, yea. [chuckles] Explains, uh what systems I've used in the 00:02:59.292-->00:03:03.500 past. Uh how they do in store tracking operating systems uh switching to Windows 10 like I 00:03:03.500-->00:03:08.042 was saying which is kind of scary, scary thought and uh searching search engines spying 00:03:08.042-->00:03:12.125 uh uh Google. I know they track all your analytics. Uh Bing probably does too, but nobody 00:03:12.125-->00:03:17.167 uses it. So [laughter] [laughs] And I'm going to go into actual uh billboard spying. Um there's 00:03:17.167-->00:03:23.167 a couple proto type billboards and I'm pretty sure I fried the one in Minneapolis in 169. Uh, I 00:03:23.167-->00:03:27.792 was doing some research on it. I had permission at that time. So, it's uh something that they want 00:03:27.792-->00:03:32.208 They're actually tracking vehicle TPMS sensors so tire pressure monitor sensors and 00:03:32.208-->00:03:37.500 they're profiling people off of vehicles and the actual advertisements so and yea, yea 00:03:37.500-->00:03:41.083 that's pretty interesting stuff. so, um, uh, just privacy is disappearing so I thought I 00:03:41.083-->00:03:46.375 would do a privacy talk and uh, yea. Explanation of the targeted personalized advertising so I'm 00:03:46.375-->00:03:49.833 going to go through a lot of the advertising um, personalized ads. Um, they're getting really, 00:03:49.833-->00:03:54.000 really creepy. They got really creepy for a while there and then they realized that people 00:03:54.000-->00:03:57.833 were getting creeped out and they kind of backed them off a little bit. Um, behav- behavior 00:03:57.833-->00:04:02.792 advertising cookies, um, I'm going to go into they track you on, basically, what your 00:04:02.792-->00:04:05.833 hobbies, automotive, electronics, travel, where you've been, things like that. 00:04:05.833-->00:04:08.750 Um, collection of non identifiable information, so they tell you that it's a lot of 00:04:08.750-->00:04:13.083 it's metadata but there's been plenty of talks in the past of how to reverse um, metadata. 00:04:13.083-->00:04:17.167 There was actually some medical ones where they had people that had um, diseases and things like 00:04:17.167-->00:04:21.000 that that they were actually to reverse able to reverse those two specific people once there 00:04:21.000-->00:04:26.875 was an actual uh breach. So, yea and uh real time bid information which is one of the buzz words 00:04:26.875-->00:04:31.500 that's out there so basically people are buying us like we're cattle and uh this is basically 00:04:31.500-->00:04:34.833 geared at jacking up every single analytical they use for it and making the data 00:04:34.833-->00:04:40.458 completely useless. And, uh, yea so they have software advertising displays. Um, uh 00:04:40.458-->00:04:46.958 private marketing um, PMP. Uh, basically wasting um, advertiser’s money and yea, 00:04:46.958-->00:04:51.083 there's uh explanation of technology uh tracking online so I'm going to go through some of 00:04:51.083-->00:04:57.042 them. I'm gonna explain how deep and dive in the operating system are and when you try to uh, uh 00:04:57.042-->00:05:00.625 neuter Windows 10 how it fights back. [chuckle] because it is a very, very intrusive operating 00:05:00.625-->00:05:04.750 system. Um, yea it's it's uh what's to be expected when you know they are pushing a lot of 00:05:04.750-->00:05:08.125 those updates and stuff like that. So, how it impacts the users. How it impacts the 00:05:08.125-->00:05:11.833 business. Um, I know that's something where I don't mind if you know they know what my 00:05:11.833-->00:05:15.125 mother's doing on a day to day basis or I'm sure she doesn't either, but when it's your 00:05:15.125-->00:05:20.500 actual employees, um, if anybody is in the sys admin or security uh admin role and uh it makes a 00:05:20.500-->00:05:24.375 lot of these call in services um hard to track, especially when we're trying to see if things 00:05:24.375-->00:05:28.583 are calling out or Trojans or droppers or any kind of malware is calling out and stuff like 00:05:28.583-->00:05:32.667 that. It adds a lot of tr- .unnecessary traffic. And I'm going to go into GPS tracking. 00:05:32.667-->00:05:37.417 I, uh, off of IP addresses, uh so on the whole they'll track what an entire company is doing. 00:05:37.417-->00:05:42.792 If they have one IP address, so. WIFI Beakuer- uh beacon information. So how they uh, 00:05:42.792-->00:05:48.875 actually go through cellular tracking and um, um turn on WIFI for accuracy. Obviously, uh 00:05:48.875-->00:05:53.083 everybody has their WIFI off here, but uh, there's you know, on in the average world when 00:05:53.083-->00:05:56.833 you're walking around the mall it's amazing to me the information they collect . And 00:05:56.833-->00:06:00.750 uh, yea, arts, entertainment this is some of the actual breakdowns of how ads are 00:06:00.750-->00:06:06.417 personalized and uh sales a bit. It's very, very boring stuff. I, I feel, [chuckles] that I don't 00:06:06.417-->00:06:09.583 need to go into much detail on this and I'm sure I've got a lot of you guys have have done a lot 00:06:09.583-->00:06:14.375 of research on actually running ad blockers or black holing advertisements. Um , I recommend 00:06:14.375-->00:06:18.375 that for everybody, not only just for security purposes but even legitimate web pages can 00:06:18.375-->00:06:23.458 have drive by attacks um, there are several exploit kits that um, um have had have drive bys 00:06:23.458-->00:06:27.875 in the past on legitimate web pages, place- pages that I would visit without any hesitation 00:06:27.875-->00:06:33.792 normally. So, and yea. So there are some uh good ways to stop tracking uh right now and I just 00:06:33.792-->00:06:38.083 wanted to uh uh give a plug to some of these they are all open source. Uh They're all free. Um, 00:06:38.083-->00:06:43.333 so they have ad blocker apps. They have um, actual black holes which basically the advertisers 00:06:43.333-->00:06:48.250 don't know that their ads aren't being showed, which is a little more stealthy. Um, Trackmenot is 00:06:48.250-->00:06:54.042 the actual uh hypervisor version that I wrote as a plug in for um, uh, the uh actual program at 00:06:54.042-->00:06:58.792 this IO address. It's pretty amazing it literally crawls the entire web [chuckles] web page 00:06:58.792-->00:07:03.042 that you send it to and it will click all the advertisements. In a safe manner obviously. Uh, but 00:07:03.042-->00:07:06.208 it basically jacks up a lot of it and I actually added a hypervisor version because they 00:07:06.208-->00:07:10.750 banned this plugin on Chrome. So I got it so it's working on Chrome again and it actually 00:07:10.750-->00:07:15.750 does um uh lots of XML injection er um a keystroke injection into the actual browsers themselves 00:07:17.708-->00:07:22.250 so it's something where um it happens at a later where you're not going to trigger a lot of 00:07:22.250-->00:07:25.500 the uh, I'm not a robot and a lot of the security features. So that is something I'm also 00:07:25.500-->00:07:31.208 releasing open source and it'll uh, I'll have a working version for uh VMware, that once it's 00:07:31.208-->00:07:33.833 out of the beta phase here, everyone will be able to download it and if as long as 00:07:33.833-->00:07:37.917 you have VMware workstation or um some of the open source will also work for it. So the OVAs 00:07:37.917-->00:07:42.417 you'll be able to launch them and uh, I'll go into a little bit of uh, other things that I 00:07:42.417-->00:07:46.833 am actually blocking from Microsoft. So, and uh yea. The e- uh- Privacy Badger is a 00:07:46.833-->00:07:51.875 really good EFF loves porting them. Uh, there's paid VPNs uh 4 dollars a month. You can get a 00:07:51.875-->00:07:56.333 decent VPN service. Um some of the free ones, who knows what they did. It's uh, [chuckles] 00:07:56.333-->00:08:00.333 probably worse than uh letting them know your advertising is some of the stuff that those IP 00:08:00.333-->00:08:03.042 addresses were previously used for. So that's something that I would uh definitely recommend 00:08:03.042-->00:08:06.208 that you do your due diligence when you're checking into that stuff so. And it's all a very 00:08:06.208-->00:08:11.875 good start um tackling some of the call homes um doing a uh actual blocker on the hosts 00:08:11.875-->00:08:16.500 files so it blocks a lot of uh Microsoft call home type stuff. Uh, turning off your peer to 00:08:16.500-->00:08:20.958 peer networking um for updates and stuff like that. So and uh what do I have against Ads 00:08:20.958-->00:08:26.167 Weston? That's uh that's what my wife asked me and, uh [chuckle], yea I know it's something that 00:08:26.167-->00:08:30.542 um I don't mind at all. I hate having advertisements. Anytime they offer something like uh, uh 00:08:30.542-->00:08:33.875 youtube red or something like that where it'll they still collect a lot of information but 00:08:33.875-->00:08:37.292 it's something where if I don't have to see an advertisement I will gladly pay for it. I'm not 00:08:37.292-->00:08:40.958 trying to uh, that's the way that the internet is free, I understand that. Um it's all, I 00:08:40.958-->00:08:46.042 will I will gladly pay for a lot of the uh, uh, premium services and anything that's ad free and 00:08:46.042-->00:08:51.208 uh even some of the android stuff it's uh amazing that you can't actually you know turn off 00:08:51.208-->00:08:55.333 a lot of the tracking and it's something that, um, as the more and more they they can snag you 00:08:55.333-->00:08:58.625 with the convenience and then they add some of the more intrusive stuff and that's just 00:08:58.625-->00:09:03.500 been happening over uh the last few years. So, yea and um I'm going to be able to um, um 00:09:03.500-->00:09:08.458 should go into some yea uh disable some of the browsing tracking. They let you know 00:09:08.458-->00:09:12.583 there's cookies. They try to do all these things to let you know uh, what they're doing or make 00:09:12.583-->00:09:15.917 you, make them look like they're more of an accurate and good demonstration of what they're 00:09:15.917-->00:09:19.417 actually doing but uh in a lot of cases, um, it it needs a little bit more intervention and 00:09:19.417-->00:09:23.500 that's why I love that there's uh tools like on these last page here that people can actually go 00:09:23.500-->00:09:27.833 out and do this kind of stuff. So, and yea, so basically drive by attacks, like I was saying 00:09:27.833-->00:09:33.000 even legitimate web pages um, uh, there's a lot of them that even the uh New York Times is 00:09:33.000-->00:09:39.583 one of the bigger ones that comes to mind. Um, that page they uh literally send out 00:09:39.583-->00:09:42.583 Twitter saying that their actual um page is breached, please don't visit it. So, uh yea that 00:09:42.583-->00:09:45.250 was a drive by I believe it was a java or a flash drive by attack. so it was literally just 00:09:45.250-->00:09:48.083 by visiting the page it would uh actually execute some of the code on there. so, uh since the 00:09:48.083-->00:09:53.125 late 90's it's been one form or another in tracking and uh they're um yea their uh deep 00:09:53.125-->00:10:00.333 diving they're getting their analytics more tight and uh it's been used in stores. Uh, the 00:10:00.333-->00:10:04.375 act- actually the brick and mortars I'm sure everybody in 2012 heard about these you know 00:10:04.375-->00:10:09.042 they're tracking everything and the stores that were doing it got a lot of feedback that was 00:10:09.042-->00:10:13.750 negative so they quit doing it and then they tried it again two years later, heh and uh they're 00:10:13.750-->00:10:16.958 right back up to the same old tricks. so that's something where um, in the in store 00:10:16.958-->00:10:20.875 analytics it's no problem at all I have no problem at all if people opt into it, um that's 00:10:20.875-->00:10:26.208 definitely like something if somebody wants to save 10 percent, 10 cents on their gas 00:10:26.208-->00:10:27.708 or something by all means if that's something they accept, I have no problem with at all with 00:10:27.708-->00:10:31.000 that, but it's when um, uh they actually you know start tracking cellular beacons of how many 00:10:31.000-->00:10:34.708 customers walk by, their attention rates, their dwell times in the store and things 00:10:34.708-->00:10:38.917 like that. I'll actually go into some heat mapping analytics and things like that. So, which 00:10:38.917-->00:10:42.333 that's uh, yea I have no problem at all with opt in programs. That's one of the biggest 00:10:42.333-->00:10:44.750 things. so they uh track some of the bluetooth cellular beacons, uh, wifi, uh, infrared and 00:10:44.750-->00:10:51.750 motion sensors, Um, yea, several years they began getting negative press like I said so uh 00:10:51.750-->00:10:56.125 there's been lots of of resistance on all forms of tracking. Apple and a couple of 00:10:56.125-->00:10:59.625 other several manufacturers are doing very, very randomized beacon information which is 00:10:59.625-->00:11:04.458 awesome to see and uh it's definitely been a long time coming for it. So uh, UK and 00:11:04.458-->00:11:08.125 other uh areas in the world been less resistance from what I've seen. I know a lot of uh, um. 00:11:08.125-->00:11:13.083 actual tracking that they have out there is pretty, pretty readily available. So, I'm told 00:11:13.083-->00:11:17.917 it's been turned into meta data and I've already explained about some of the weaknesses in 00:11:17.917-->00:11:22.708 metadata and reversing it and uh this the 45 dollar device that uh everyone single one of you 00:11:22.708-->00:11:25.750 should bring and go to the mall with you every time cause uh, this actually, uh basically what 00:11:25.750-->00:11:34.458 it is it's a huge uh wireless beacon generator and it actually it can generate up to a 150 00:11:34.458-->00:11:42.667 beacons, um and they can be one of several things. It can either be, um, so it can either be uh, 00:11:42.667-->00:11:45.708 cellular beacon, so they make it look like a customer's walking around they can actually be 00:11:45.708-->00:11:49.125 rogue access points, they can be pretty much anything you can generate cellular with a laptop 00:11:49.125-->00:11:54.375 you can now generate with these and uh I actually have a program called Groundhog's Day where it 00:11:54.375-->00:11:57.917 replays the exact same days worth of traffic so it looks like the same people are walking 00:11:57.917-->00:12:03.125 by and uh, huh huh, it is a pretty neat neat process and actually jacks up there uh in 00:12:03.125-->00:12:08.708 store analytics, their retention rates, all the heat mapping, uh, cause uh with the more advance 00:12:08.708-->00:12:12.750 version with the actual Raspberry Pi attached to it, you can um actually change where 00:12:12.750-->00:12:16.542 people are dwelling in the store and stuff like that so it's a a really really cool project and a 00:12:16.542-->00:12:21.833 a that's all going to be open source on my key lessons I will release how to actually build 00:12:21.833-->00:12:24.167 one of those. Um, I highly recommend it. They're pretty fun uh if you haven't played with 00:12:24.167-->00:12:27.417 wireless before. So [off microphone statement] Oh, sorry about that, yea thank you. And 00:12:27.417-->00:12:30.833 um metadata is used to change the store lay outs. So, say for example, if uh everybody goes to 00:12:30.833-->00:12:35.167 the front panel they're going to you know start throwing the more high price items there things 00:12:35.167-->00:12:38.500 like that. Um, if they realize everyone is going back to electronics right away they're 00:12:38.500-->00:12:41.542 going to put a lot of the stuff to try to sell to people with on the way there. And more 00:12:41.542-->00:12:45.750 specifically lay lay outs increase sales and make us more along the lines of uh just 00:12:45.750-->00:12:51.042 consumers. So, and using regards programs um yea like I said opt ins I have no problem with that. 00:12:51.042-->00:12:54.667 Uh I did a little research on some of the coupons that are pushed and some of the actual 00:12:54.667-->00:12:58.500 bluetooth tracking. Um, those things are literally built for like the year 2023. They're uh 00:12:58.500-->00:13:03.167 not impossible to break but I uh did not have the time the uh free time this to year to 00:13:03.167-->00:13:06.375 actually start uh dabbling with this. Uh, last year I actually did um some uh ticketed 00:13:06.375-->00:13:10.542 injection but I did the responsible disclosure with it so it's something where I 00:13:10.542-->00:13:15.542 wouldn't yea it wouldn't work anymore so nobody would really care. Heh, for the majority of 00:13:15.542-->00:13:19.833 it so. So they increase how much they >>Move the mike closer. >>Oh, sorry about that. Yea, 00:13:19.833-->00:13:23.333 here we go. And uh yea so basically they can increase how much they charge for certain 00:13:23.333-->00:13:28.000 store areas if people have it in there. So [audience laughing and clapping] Sorry about that guys. 00:13:28.000-->00:13:31.083 Heh, heh. Yea, thanks for the brave soul that told me to a bring it up a little closer so 00:13:31.083-->00:13:35.167 uh. So uh yea it changes the ad placement in the physical and the web because they are 00:13:35.167-->00:13:38.833 tracking across platforms. So, and they have all the collection on the cellular bluetooth 00:13:38.833-->00:13:45.167 beacons so they're collecting all DSN information um they have actual they've weaned away from 00:13:45.167-->00:13:49.375 this one big time because it's uh very very intrusive and um some of them have pretty decent 00:13:49.375-->00:13:54.875 ranges on them so um they're not as um acceptable for as far as if people are going through 00:13:54.875-->00:13:59.292 actual uh communication with them. So, and uh how do you harden the communication best 00:13:59.292-->00:14:02.917 practices? Um, yea that's something I will be going through here in a little bit. 00:14:02.917-->00:14:07.792 So, and uh who knows what TPMS sensors are for vehicles? Yea, there's been lots of really 00:14:07.792-->00:14:11.625 really cool research. Um, uh so they have smart billboards. Uh, they just throw the word smart 00:14:11.625-->00:14:15.458 in front of it and charge people for it but it something where gonna basically be tracking 00:14:15.458-->00:14:19.250 beacons. They'll be able to profile the you know that that guy driving that 2015 Jeep 00:14:19.250-->00:14:25.500 Cherokee or whatever. They'll be able to tell that that person's most likely a white, 32 year old 00:14:25.500-->00:14:29.542 male and they will be able to answe..uh uh get more of the advertisements or they'll be 00:14:29.542-->00:14:33.250 able to uh you know generalize how much they're actually are able to charge for some of the 00:14:33.250-->00:14:38.250 information, be able to track people a lot more and uh in the US uh after 2007 they required 00:14:38.250-->00:14:43.000 it it in a majority of the vehicles except for special pur uh purpose built vehicles. Uh so 00:14:43.000-->00:14:49.125 basically it uses unencrypted RF um 350..um 314 uh majority of it so depending on the actual 00:14:49.125-->00:14:53.417 vendor. Anytime you go over 19 miles per hour it will do a call home feature, so and um I'm 00:14:53.417-->00:14:59.125 going to be actually [mouth sounds] uh demoing the uh in the car hacking village I have a 00:14:59.125-->00:15:02.333 TPMS sensor where you can actually add 3 sets of tires to your vehicle so that's something 00:15:02.333-->00:15:05.917 that Ford owners have not been able to do without going into a dealership all the time. So it's 00:15:05.917-->00:15:11.125 something where you can have your snow tires, racing tires, but I, and your um whatever you 00:15:11.125-->00:15:13.875 know whatever other kind of tire other tires you want. Um and something that um I actually 00:15:13.875-->00:15:18.083 made it so my wife my wife's vehicle every time it starts up it will actually generate a new 00:15:18.083-->00:15:23.208 uh TPMS sensor and it will flash it into her cam bus so it will it's pretty hard to actually 00:15:23.208-->00:15:27.250 track the vehicle and it's just one step further uh hopefully people will adopt those kind of 00:15:27.250-->00:15:30.167 things uh once they start tracking more of that beacon information. So, and uh 00:15:30.167-->00:15:34.083 yeah, that right now that's one of majorities that they're actually testing and I'll be 00:15:34.083-->00:15:42.875 doing the demo of that on an actual car hacking village. So yea and everybody's for the most 00:15:42.875-->00:15:44.708 part I don't need to go into social media. Uh, that is literally just that is pretty 00:15:44.708-->00:15:47.000 much nothing but data collection. Um, there's been several jokes. I love one of the 00:15:47.000-->00:15:51.833 Onion ads where they had Mark Zuckerberg is like an FBI agent and it's uh heh heh yea they got 00:15:51.833-->00:15:55.167 some pretty accurate stuff like that and it's uh abused in the past um it's just they're 00:15:55.167-->00:15:58.333 literally just tracking everything on it and it's it's something that we that they 00:15:58.333-->00:16:01.958 willingly accept to be able to uh you know send cat memes and things like that to each other. 00:16:01.958-->00:16:06.000 So, and uh, reversing the randomness so when I went through an actual pages it was 00:16:06.000-->00:16:10.417 pretty simple. I uh start with a dummy account on a VPS and it would start searching a specific 00:16:10.417-->00:16:15.792 dialogues um of things that I would think that people's personalities. I would think of 00:16:15.792-->00:16:19.375 a friend and then I would think of things that they would search and I would think of that age 00:16:19.375-->00:16:22.333 right now. I would think of my niece and things she would search. What my cousin would 00:16:22.333-->00:16:25.583 search. What my uncle would search. A lot of that stuff, so that's something that where I 00:16:25.583-->00:16:29.250 was kind of looking at what they were reversing and what they were advertising with. So I 00:16:29.250-->00:16:32.375 built out a huge uh spread sheet that is actually gonna be something else I'll also be 00:16:32.375-->00:16:37.333 releasing with these tools. Um and it basically shows that what what what you're profile and how 00:16:37.333-->00:16:40.958 to build a profile cause that's actually what the uh program that I made is you can set 00:16:40.958-->00:16:44.667 yourself to say for example the example I was giving was a 12 year old girl who likes horses 00:16:44.667-->00:16:50.458 and uh you you'll be looking at how to flash um a firmware on it ubertooth one and the next thing 00:16:50.458-->00:16:54.292 you know she your searching if does he like me you know where are the best horse ranches. 00:16:54.292-->00:16:58.542 Things like that. so, You will be able to throw in some pretty random details and it's actually 00:16:58.542-->00:17:03.667 a plug in for uh that amazing program that I was talking about earlier um they they do a very, 00:17:03.667-->00:17:06.917 very good job at random stuff, but uh some of the random stuff that you gets thrown into 00:17:06.917-->00:17:12.042 unlogical bins where they don't even get advertise to or they get very very low resale. So 00:17:12.042-->00:17:16.375 these actually keep you looking like a real person on the web uh because eventually when enough 00:17:16.375-->00:17:20.208 people start using blocking services like that they're going to start actually deep diving 00:17:20.208-->00:17:24.292 into a little bit more into the actual uh details and the software of it. So, and yea back 00:17:24.292-->00:17:29.750 into the old XPDs uh they really didn't store store much information. Huh, huh. and uh 00:17:29.750-->00:17:36.750 yea 1984 style moving into Windows it's literally amazing the uh amount of information 00:17:36.750-->00:17:40.083 they collect and I have been a huge fan of uh doing misinformation type talks like 00:17:40.083-->00:17:43.708 the the one that I actually did was um uh injecting fake credit card numbers for credit card 00:17:43.708-->00:17:50.542 skimming software. So, like it's like it's all about like if I can't have my data, nobody can 00:17:50.542-->00:17:52.417 kind of situation. So, it's like it becomes so useless they won't actually want it anymore and 00:17:52.417-->00:17:57.500 that's kind of the thought in the process behind it. And, yea. An explanation of attacks so 00:17:57.500-->00:18:00.708 blocking the billboard spying um I'm going to go through that with a TPMS sensor and uh 00:18:00.708-->00:18:03.792 explaining the actual main attack surface of the past several monitoring systems. So 00:18:03.792-->00:18:07.167 how brick and mortar stores are spying on people and how web and OS are spying on people, so that 00:18:07.167-->00:18:12.417 will be the next phase of this. And uh some methods of stopping some billboard spying. Since 00:18:12.417-->00:18:16.625 billboards there >>Louder! >>Oh, they're picking up uh this, this microphone. I apologize really 00:18:16.625-->00:18:20.583 here. So, [laughs] so, smart billboards they capture the wireless sensor information. Uh, 00:18:20.583-->00:18:26.333 they capture all but based on the model year of the car, the age range, income range. Uh, if 00:18:26.333-->00:18:29.917 you're if you're driving a brand new Lexus you're most likely not a McDonald's employee and they 00:18:29.917-->00:18:34.125 like to profile it like that and that that's just one more of the things where it dehumanizes a 00:18:34.125-->00:18:39.458 lot of the information. So, and uh passive and opt in programs once again like I said uh people 00:18:39.458-->00:18:43.833 have a lot of applications for tracking through a lot of the extra moldings uh uh public 00:18:43.833-->00:18:50.458 transit systems and stuff like that so and like I was saying uh you can add um a lot of the not 00:18:50.458-->00:18:53.417 not necessity of having to go into a dealership which is really really nice because um uh 00:18:53.417-->00:18:57.542 Ford and Lincoln vehicles is the one that have the tool that I'm working for now and it's nice to 00:18:57.542-->00:19:02.458 actually be able to install um uh like a Groundhogs Day type of situation, so you cycle through. 00:19:02.458-->00:19:07.167 The one that I have that would be more practical is adding a 10 tire TPMS sensors and cycling 00:19:07.167-->00:19:11.167 through them. Uh so that's something where it's not randomly generating them uh 00:19:11.167-->00:19:15.667 because that is a bit more of a lengthy process especially um uh once a week you actually have to 00:19:15.667-->00:19:21.083 do a hard flash uh to actually add some of your TPMS sensors. So, and yea, so what's being 00:19:21.083-->00:19:24.667 collected and then what allow them to uh profile me online that was one of the the biggest 00:19:24.667-->00:19:28.167 things that was uh the collection of the information once I logged it all uh it's 00:19:28.167-->00:19:33.000 something that was it was pretty interesting. Um, what slight changes would uh change in 00:19:33.000-->00:19:35.708 advertisements and things along those natures especially when it's starting to getting into 00:19:35.708-->00:19:39.792 getting into higher profile travel um you can also see where people are spending a lot of the 00:19:39.792-->00:19:43.792 money, uh, for actual click to pay advertisements and stuff like that. So, uh, how do they 00:19:43.792-->00:19:47.833 use it? Uh, who who is it interested to? Who's buying it? Uh, how is the information held 00:19:47.833-->00:19:52.708 against people. They've uh done there's actual FBI portals uh and things like that for you 00:19:52.708-->00:19:56.583 know a lot of this information so they don't have to actually submit warrant er, they have to 00:19:56.583-->00:19:59.375 do warrants and everything like that they have to do the the due process. It's just something 00:19:59.375-->00:20:04.625 that they actually have to uh yea they have to keep it up so. And how's that yea all the 00:20:04.625-->00:20:08.750 information for portals for law enforcement uh one of the biggest ones I have known is the 00:20:08.750-->00:20:16.542 the ones for an actual cellular communications. So, and yea, um. So basically injecting the pulse 00:20:16.542-->00:20:19.917 data, uh, changing your profile um how much information do you have to do to combat your years 00:20:19.917-->00:20:25.042 of of profiling. Um, one of the biggest things I did a couple of years ago was I started like 3 00:20:25.042-->00:20:28.958 Google accounts and then I switched in between them. Didn't even trick them because of a lot 00:20:28.958-->00:20:32.708 of the information that they picked up they still profiled it as the same person. Um so I'm 00:20:32.708-->00:20:36.208 going to go into a little bit of the profiling changing and actually throwing off some of 00:20:36.208-->00:20:41.750 the lower level analytics and uh who knows what type fisting is? Huh, huh. Yea it's uh like a 00:20:41.750-->00:20:45.958 World War 2 based on when people did the tap the actual morse code and stuff like that It's 00:20:45.958-->00:20:50.250 something where they would have been able to tell where somebody was in Germany based on the 00:20:50.250-->00:20:53.875 actual way that they typed their information and that's one of the actual analytics set up that 00:20:53.875-->00:20:56.458 uh that Windows 10 is collecting so that's part of that hypervisor that I built is it 00:20:56.458-->00:21:00.583 actually collects your all of your keystrokes and actually injects them out and into the 00:21:00.583-->00:21:05.458 operating system or whatever your selected tab is and uh in for and um 38 you can select the 00:21:05.458-->00:21:08.417 stroke per minute depending on how fast you type but it basically pops it out so there's 00:21:08.417-->00:21:12.083 no type fist so it can't tell if it's you using your computer or your wife using your computer 00:21:12.083-->00:21:16.500 and uh there's a couple other uh ways that you could do a lot of this stuff um it can be used for 00:21:16.500-->00:21:21.375 injection of typing um you can do um I'm working on mouse click uh emulation and simulation 00:21:21.375-->00:21:25.042 that's undetectable and things like that, so, it will be a a pretty decent project once it's 00:21:25.042-->00:21:29.417 uh plea..complete so and then we're going to go through through the browser bot and uh 00:21:29.417-->00:21:33.333 how to not get det..detected by search engines and web browser programs that was one of the 00:21:33.333-->00:21:37.792 biggest things uh right away it was uh kept busting me and it just was a little disheartening 00:21:37.792-->00:21:41.833 at first so but yea uh so yea. A lot of the r..um, I'm not a robot uh who who saw that 00:21:41.833-->00:21:49.375 originally they got like how hard can that be to beat, then they try to beat it. Huh, yea 00:21:49.375-->00:21:54.583 it's actually huh a pretty well thought out process um uh so a lot of the it's not just about 00:21:54.583-->00:21:57.250 the clicking it's about the naturalness of how it is clicked so that's something that we're 00:21:57.250-->00:22:02.750 um if you're able to push mouse clicks from a hyper visor um it's a lot more uh accurate in 00:22:02.750-->00:22:06.375 detail and you can tune it a lot better and it also makes it so that everybody can use it you 00:22:06.375-->00:22:10.208 don't have to have low level details of actually how to um program a lot of the stuff so 00:22:10.208-->00:22:15.958 and yea and so yea you can basically um go through the joys of watching your advertisements 00:22:15.958-->00:22:21.000 change first hand. You can throw off your analytics a little bit and um based on your actual 00:22:21.000-->00:22:25.125 advertisements you can reverse that to what they profile you as and as that that's actually 00:22:25.125-->00:22:28.958 pretty creepy uh based on the actual data based information you can actually see that they 00:22:28.958-->00:22:33.125 know that you're, you know, in your mid 30's and you love vehicles and computers or 00:22:33.125-->00:22:37.958 whatever your ser..uh things are. So there's ways to actually go uh the reversing process it's 00:22:37.958-->00:22:42.042 uh it's a pretty decent process if you guys haven't ever mapped anything out like this, um 00:22:42.042-->00:22:45.667 search engines are really really easy to do and it's uh definitely something if you're 00:22:45.667-->00:22:49.125 wanting to get into a data project with some of your friends. So, and yea, basically 00:22:49.125-->00:22:53.542 uh yea. This mal ware can actually be used to uh do bad things. So you could actually uh 00:22:53.542-->00:22:57.917 like a hypervisor like that I was looking at that where somebody could actually use it 00:22:57.917-->00:23:00.875 as frameware. They could make people visit bad web pages things like that so that's one 00:23:00.875-->00:23:05.667 more reason that you're going to want to integrate something that will keep track of what your 00:23:05.667-->00:23:09.292 actual analytics are and what it's actually conveying and you can actually frame somebody uh 00:23:09.292-->00:23:14.458 it could basically damage somebody's life or even worse it could like Nickelback on 00:23:14.458-->00:23:18.167 Facebook. So, [audience laughing] Huh, huh, I just had to bash on Nickelback because 00:23:18.167-->00:23:23.750 they are the worse worse thing to come. but yea, and uh there's basically a um yea yea it's also 00:23:23.750-->00:23:27.375 used um if you want to do some testing for malware a lot of the mal ware looks to see if the 00:23:27.375-->00:23:32.833 virtual machine is used and it's something where you can get some actual um real real world case 00:23:32.833-->00:23:37.250 usage um I know it's something uh without paying you know 50-->000 dollars for their uh 00:23:37.250-->00:23:40.958 really expensive BMs that are specifically for bursting mal ware it's something you could 00:23:40.958-->00:23:45.083 make virtual machines look like they have daily usage in them. So it's something where you want 00:23:45.083-->00:23:48.042 to kick a payload off or where it kicks off 3 weeks later or something you would actually be 00:23:48.042-->00:23:52.542 able to do a bit more research on it, so, and yea basically it's the operating systems and a 00:23:52.542-->00:23:58.208 yea. So how I tried to make Windows 10 uh go off the grid, kind of, uh was basically by you 00:23:58.208-->00:24:02.833 know redoing some of the hosts seeing what it's calling out to Um, others have done that in the 00:24:02.833-->00:24:07.375 past others have failed um I failed the first few times I did it um there's actually very good 00:24:07.375-->00:24:11.125 tools um out there for blocking a lot of days they get turned right back on as soon as you run 00:24:11.125-->00:24:15.042 an update though so that's something where uh I'll be posting some of that research 00:24:15.042-->00:24:20.417 and a little bit more about uh deep dive into the operations systems of uh cause I'm sure a 00:24:20.417-->00:24:23.667 lot of you guys are adopting either for your actual users or for your actual self uh 00:24:23.667-->00:24:27.417 switching over to Windows 10 from Windows 7 and uh actually injecting from the hypervisor 00:24:27.417-->00:24:33.792 and how much information the actual uh OS detects before like a lot of the um errors and 00:24:33.792-->00:24:39.917 issues and things like that will actually submit those um and there's uh pretty much anything 00:24:39.917-->00:24:44.042 that was getting sent home to Microsoft I have made a way to send them bulls**t. so it was a 00:24:44.042-->00:24:48.917 pretty fun fun it was a fun project and it was uh I love watching actual responses of it 00:24:48.917-->00:24:53.250 so and uh yea. IP version 6 and how it changes spying on us uh some of the real time 00:24:53.250-->00:24:58.917 communication um that is uh yea some of it for as far as it like breaking um anonymity on the web 00:24:58.917-->00:25:03.458 there's lots of actual information out there for it so yea screen sizer uh screen 00:25:03.458-->00:25:06.375 sizing and browser information that was uh one of my bigger breakthroughs when I was um 00:25:06.375-->00:25:11.292 going through how they were actually uh tracking a lot of uh uh um um details from some of 00:25:11.292-->00:25:15.792 the posts and get requests and things like that so and uh type fisting is something that um yea 00:25:15.792-->00:25:22.083 it's basically uh something Windows 10 they've been uh collecting I don't see any 00:25:22.083-->00:25:26.208 reason that they would need to do that uh aside from per user basis. Um there's some pretty 00:25:26.208-->00:25:30.583 cool uh research on people like being able lock machines if they feel that somebody else is 00:25:30.583-->00:25:34.458 typing at the machine or something like that uh so I've seen a couple of programs like 00:25:34.458-->00:25:39.667 that and a type fisting app would be able to be a pen testing tool for something like 00:25:39.667-->00:25:46.708 that but but yea no so we do the XML and HTML injection uh yea and it's basically a macro based 00:25:46.708-->00:25:51.125 injection so um I add the most simple simple version of it is ghost writer if you want it to 00:25:51.125-->00:25:55.917 literally inject things out of uh uh text file you can do that. Um you can use some of the plug 00:25:55.917-->00:26:00.375 ins for some of the other applications that are out there and uh yea there's like I said 00:26:00.375-->00:26:04.750 it interacts with other programs by um if they're brought to front or if they're a select a window 00:26:04.750-->00:26:09.458 and you can change a lot of the functionality with that um there are some CV plugins that people 00:26:09.458-->00:26:15.083 have um for desktop support uh applications and I'll also be posting and referencing to so um 00:26:15.083-->00:26:19.708 and can Windows stop this and it's easy to use so it something that um I have not seen um 00:26:19.708-->00:26:25.958 Microsoft combat any of the uh actual anti type fisting or any of the hyper visor inner 00:26:25.958-->00:26:31.000 intervention. That's something that where it also does a lot of really really cool stuff like 00:26:31.000-->00:26:35.833 blocking um some of the hid attacks like human interbase stuff like device attacks it 00:26:35.833-->00:26:39.250 blocks like some of the bash bunny attacks uh because it basically hijacks any input um 00:26:39.250-->00:26:44.667 quite literally any input unless it's uh uh pre detected device so and you can uh also have it 00:26:44.667-->00:26:49.292 released so it's a very very cool concept and yea I'm excited to see people's feedback on it 00:26:49.292-->00:26:53.875 and yea be able to grow it and see what other people do and maybe other people can clean up 00:26:53.875-->00:26:58.000 the code. There's a lot better programmers out there than me so and yea basically blocking out 00:26:58.000-->00:27:01.792 the outputs from your phone there's a couple programs out there that um uh are pretty nice 00:27:01.792-->00:27:05.792 that you don't have to actually rip you phone which is amazing because I know several years ago 00:27:05.792-->00:27:09.292 if you wanted to delete uh the foot like the like I know there are some guys that are computer 00:27:09.292-->00:27:13.875 guys and football guys but I have no interest at all in the NFL or Nascar or some of that 00:27:13.875-->00:27:16.750 other stuff they have loaded onto my phones and it's just nice to have be able to have uh 00:27:16.750-->00:27:21.958 yea uh basically it frees ways to get rid of all that information so and um yea so you 00:27:21.958-->00:27:27.792 can generate um also there's um a lot of applications that will read 50 SMS messages a day or 00:27:27.792-->00:27:33.333 they'll read 50 emails and uh they have their end user license agreement or EUA 50 uh where 00:27:33.333-->00:27:37.083 they have the they basically read your emails so they can better tailor uh either your 00:27:37.083-->00:27:41.875 typing or your auto completion. They'll give you a lot of examples like that but it's uh 00:27:41.875-->00:27:48.417 most likely for other uses so yea and airplane mode um working on making uh I have an HGC1 or 00:27:48.417-->00:27:55.708 HGC 10 now and I I did a PRL hack so it actually doesn't attach to uh fake uh fake cell 00:27:55.708-->00:27:59.958 phone towers. and also I'm having a DEFCON mode and I'm sure a couple of other people 00:27:59.958-->00:28:03.292 have the switch on the side of their laptop that they used as DEFCON mode before but yea 00:28:03.292-->00:28:07.208 basically it turns off your radios does not allow you to uh turn off your radios it reminds 00:28:07.208-->00:28:11.583 you a week before to change all your one time passwords call in information so and yea I'm going 00:28:11.583-->00:28:14.625 to go over the actual hardware that I'm going to be demoing here in a second and uh this is 00:28:14.625-->00:28:18.250 actual look into the in store tracking systems. So heat mapping so they track how many 00:28:18.250-->00:28:22.500 people walk by the store and they see how many people actually walk into the store. 00:28:22.500-->00:28:27.292 where the people actually dwell. Um so this device actually I just ordered as many radio 8 O 2 00:28:27.292-->00:28:32.125 11 compliant things as I could and started slapping them on an arduino and it's a pretty fun 00:28:32.125-->00:28:36.250 project I definately recommend you build them you can build them for around 35 to 45 dollars 00:28:36.250-->00:28:43.750 and uh it basically um..uh there's a collection mode where you can collect the beacon's 00:28:43.750-->00:28:47.667 like I was saying for a Groundhog's Day type attack or you can actually ee edit your 00:28:47.667-->00:28:51.542 own text files and then you can pop in your own beacon information so you can basically 00:28:51.542-->00:28:56.167 have it look like hundreds and you know if you built one bigger than this or you actually got a 00:28:56.167-->00:29:00.000 full blown boards on these ones you could actually build it out to the point where you could 00:29:00.000-->00:29:06.167 have uh 3 to 400 access points so or beacons or whatever those things and uh heat mapping. Uh 00:29:06.167-->00:29:10.583 so there's an actual threshold um so there's basically they attract people there’s classic 00:29:10.583-->00:29:15.208 people tracking awesome OK yes there's classic people tracking and it's going to go through um 00:29:15.208-->00:29:19.458 you know actual infrared. It will count a ticker it's literally just as if somebody is 00:29:19.458-->00:29:23.333 uh tripping an I beam. So I actually built an infrared blocker for that. A heat mapping 00:29:23.333-->00:29:27.583 my actual application when you hook it up to Raspberry Pi you can make it look like people are 00:29:27.583-->00:29:31.542 walking in a circle in a store and it is really really creepy I couldn't use the actual software 00:29:31.542-->00:29:36.708 uh because I would most likely get sued or at least get a cease and desist letter uh but yea 00:29:36.708-->00:29:40.292 it's uh pretty interesting stuff there's um uh older software that is really really fun to see 00:29:40.292-->00:29:45.625 the reactions of it so and yea. I'm going to be uh er..the actual device that's going 00:29:45.625-->00:29:51.125 through here so you can ba.. basically um look at the strange responses from the uh uh the 00:29:51.125-->00:29:54.792 actual system and it will uh do some of the uh re-beaconing and some of the other device 00:29:54.792-->00:29:59.542 reactions so and this is the actual radio that we're going to be demoing here and yea this is 00:29:59.542-->00:30:04.917 a CB based so yea they basically uh you peel the threshold with a really really high powered 00:30:04.917-->00:30:09.708 infrared laser uh you can basically um yea. It basically makes all the uh actual 00:30:09.708-->00:30:15.750 analytics shut down um so after about an hour of this um it had useless data after 3 hours it 00:30:15.750-->00:30:21.125 literally made the entire store black like that . [laughs] and it yea it was pretty decent so 00:30:21.125-->00:30:25.292 but yea I'm going to go into the actual demo here um yeah I'm going to actually let it uh lay 00:30:25.292-->00:30:33.625 waste to the actual um software find radio or I got a actual capture of of the wireless 00:30:33.625-->00:30:37.125 packets so I'm going to go through that here in a second so I'm going to go into the actual 00:30:37.125-->00:30:41.417 demonstration and then uh yea. I'm going to do the Groundhog's Day attack and then I'm going to 00:30:41.417-->00:30:45.167 do the dwelling time attack so it's going to jack up all the dwelling time and um on this 00:30:45.167-->00:30:49.500 computer here I will show uh while I'm getting this demo setup I will actually show you 00:30:49.500-->00:30:53.458 uh, which is not that interesting of a demo, but uh I will do that while I actually 00:30:53.458-->00:30:56.708 set up the software finding radio demo so uh and yea. I would just like to give thanks 00:30:56.708-->00:31:02.208 to my work, um my kids, my wife who’s very very patient with me, uh Jesus, my Uncle Staci for 00:31:02.208-->00:31:06.917 giving me my first Zenith easy PC, um DEF CON for having me speak for the fourth year in a 00:31:06.917-->00:31:10.667 row. It's an honor and uh audience for listening to me and especially when I have to bobble 00:31:10.667-->00:31:14.083 a microphone in front of me. I have to I apologize for that and I can't wait to hear the trolls 00:31:14.083-->00:31:18.000 on youtube on that one so.. [laughing] huh,huh hey they already said I sound like Beavis 00:31:18.000-->00:31:21.500 and Butthead on my last talk because I have nervous stuff that comes out but yea follow me 00:31:21.500-->00:31:26.000 on twitter guys and uh definitely uh thanks again audience it’s uh you guys are 00:31:26.000-->00:31:29.708 what make DEF CON and I really do mean that so and yea I’m going to kick off the demo here 00:31:29.708-->00:31:47.125 so [silence] so here we go, oop [microphone sound] let's get this here yea so this one 00:31:47.125-->00:31:52.875 basically is uh uh one of the text implementations of the actual uh Word profile so this 00:31:52.875-->00:32:01.000 one is a plugin for uh this application here which basically uh it will go through and 00:32:01.000-->00:32:05.583 literally troll all the pages. I did not write this program it's something that uh I um am a huge 00:32:05.583-->00:32:08.000 fan of supporting and I definitely want to plug it on something where it literally 00:32:08.000-->00:32:12.000 goes through and clicks on all the advertisements. Um they used a randomness that was something 00:32:12.000-->00:32:16.583 that I saw as a a eventual weakness, but it's something where um you can now actually 00:32:16.583-->00:32:24.417 load your own profile in there and um you can build um sur channel on actual uh yea so 00:32:24.417-->00:32:31.708 that's basically gonna go through here what it actually will track here. Let's see. Yea 00:32:31.708-->00:32:35.917 so you can go through all the settings it's an amazing tool and it's uh very very easy um to 00:32:35.917-->00:32:39.125 actually modify if you guys wanted to start injecting your own profile information. I'm 00:32:39.125-->00:33:01.208 going to be releasing the actual app for that here soon so. Let's see. Yea I'm going to be 00:33:01.208-->00:33:05.417 powering up my radio here and uh yea. I’m going to get my Cali machine going so one second 00:33:05.417-->00:33:40.542 [microphone sound] here we go. So I’m just going to get airomon running here in a second Here's 00:33:40.542-->00:34:14.042 what an idle DEFCON looks like. Here we go. [off-mic comments] >>OK If you guys want to open up 00:34:14.042-->00:35:02.333 to questions too feel free to approach the microphone [coughing] [tapping sounds] Come 00:35:02.333-->00:35:10.750 on There we go and we of course my screen jacks up but I can't actually see it 00:35:10.750-->00:35:14.083 here. Yea we should have uh SSIDs start popping up and uh there's going to be tons of 00:35:14.083-->00:35:19.375 actual beacon information going out right now so so basically this is making uh like I was 00:35:19.375-->00:35:23.375 saying there's the Grounddog's Groundhog's Day scenario where basically it replays the same 00:35:23.375-->00:35:25.917 day so you can actually capture information that’s why it actually has two radios on there 00:35:25.917-->00:35:30.292 uh that are full blown uh dab boards for radios then the actual other smaller antennas 00:35:30.292-->00:35:34.500 get passed off to a delay where they will pop the beacon information that was passed off 00:35:34.500-->00:35:39.417 from the initial radio and uh like I said I will be releasing the actual code for this so and 00:35:39.417-->00:35:45.208 I'm glad my demo didn't blow up and you should see a couple of fake access points popping up 00:35:45.208-->00:35:49.667 here and uh there's tons of beacon information if any of you guys have uh scanner on hand so 00:35:49.667-->00:35:54.958 [inaudible off-mic comment] uh, what's up? >>Hello, Wesley. Nice talk >>Oh, awesome. [laughs] 00:35:54.958-->00:36:01.417 Sweet. Huh, [chuckles]. Yea I knew as soon as I boot, I hope they keep it appropriate 00:36:01.417-->00:36:05.750 uh, huh but no as soon as uh I booted up I should have known people were going to mess with 00:36:05.750-->00:36:10.083 it, but, [laughs], [audience laughs] Anyways, it works really good in stores cause when you 00:36:10.083-->00:36:13.875 walk into a retail store there's’ not usually a hacker waiting with a laptop booted up 00:36:13.875-->00:36:17.875 with Cali on it so hehe [laughter] so but yea I appreciate you guys coming and 00:36:17.875-->00:36:22.583 listening to me talk and uh yea I'm glad the demo worked this year and yeah [clapping] thanks 00:36:22.583-->00:00:00.000 guys [applause]