1
00:00:00,000 --> 00:00:04,900
from everyone if you're here for I hope you're here for building Google for

2
00:00:04,900 --> 00:00:09,080
criminal enterprises if not feel free to go if you don't know what that is you've

3
00:00:09,080 --> 00:00:12,760
never used internet my name's Anthony Russell and you can reach me at dotnet

4
00:00:12,760 --> 00:00:18,580
Russell it's a Twitter handle there's my Twitter Twitter profile my blog I

5
00:00:18,580 --> 00:00:23,060
usually don't like to do in-depth speaking or in-depth about me profiles

6
00:00:23,060 --> 00:00:28,740
because no one cares on things we're gonna cover today how and why this

7
00:00:28,740 --> 00:00:34,180
project was started what I how I define public data and where you can find it

8
00:00:34,180 --> 00:00:40,540
how we can scrape some public data and how we can scrape some social media data

9
00:00:41,480 --> 00:00:46,820
and then how to link those together who cares about this and why and what would

10
00:00:46,820 --> 00:00:50,680
I do to fix it and I also have a tool that I'm releasing today that I put on

11
00:00:50,680 --> 00:00:55,240
github this morning so you'll be able to download it so here's the disclaimer

12
00:00:55,240 --> 00:00:58,660
we're gonna be looking at some sensitive information today I would

13
00:00:58,660 --> 00:00:58,720
have

14
00:00:58,720 --> 00:01:02,280
appreciated if you did not harass the people that are in my slides I'm using

15
00:01:02,280 --> 00:01:06,940
real information these are straight from the tool they don't deserve to be

16
00:01:06,940 --> 00:01:10,880
harassed and I don't condone I don't condone doing illegal things with this

17
00:01:10,880 --> 00:01:18,140
information my material or my research that said everything that's in here is

18
00:01:18,140 --> 00:01:21,660
public information it's been put out by these people it's been put out either

19
00:01:21,660 --> 00:01:23,520
by them or by the government on their behalf

20
00:01:25,100 --> 00:01:28,640
and if I were to redact this information from my slides I feel like it wouldn't

21
00:01:28,640 --> 00:01:32,000
have the impact that I intended originally when I started this project I

22
00:01:32,000 --> 00:01:35,780
wrestled with this for quite some time about releasing this tool and this

23
00:01:35,780 --> 00:01:39,700
information because I don't want somebody to get hurt based on it but if

24
00:01:39,700 --> 00:01:44,100
we want things to change we really want things to change then we need to we need

25
00:01:44,100 --> 00:01:47,540
to put this out there we need to show people what can really be done and on

26
00:01:47,540 --> 00:01:49,880
that note like this is just the beginning this is just scratching the

27
00:01:49,880 --> 00:01:52,680
surface this is stuff that I put together in my free time you know if

28
00:01:52,680 --> 00:01:55,780
you're a nation-state or somebody that really wants to do harm you could really

29
00:01:55,780 --> 00:01:56,840
do a lot with this.

30
00:01:57,760 --> 00:01:58,160
also,

31
00:01:58,640 --> 00:02:00,440
I talk to an attorney, so don't sue me, bro.

32
00:02:01,740 --> 00:02:03,980
All right, so why this project?

33
00:02:05,120 --> 00:02:11,480
So about six or seven months ago, I started looking into being able to have a public profile.

34
00:02:11,700 --> 00:02:14,080
I like to do public speaking at different conferences.

35
00:02:15,460 --> 00:02:20,860
I want to be able to have a public profile for conferences and for a living resume for work.

36
00:02:20,940 --> 00:02:25,960
I'm sure a lot of you professionals like to have your resume online, so other companies might be able to find it.

37
00:02:26,520 --> 00:02:29,380
But that's a challenge because, you know, I don't want my data raided.

38
00:02:30,740 --> 00:02:39,400
So, you know, how do you keep a public profile without putting too much out there?

39
00:02:41,360 --> 00:02:45,940
So as we spoke about before I got started, I'm an OIF vet.

40
00:02:46,000 --> 00:02:50,900
I like to take challenges head on, so I wasn't about to, you know, just let this go.

41
00:02:51,940 --> 00:02:55,860
So some of the things I started to do to try and make myself private on the web,

42
00:02:55,960 --> 00:02:59,400
was I opted out of all the things, like everything I could find.

43
00:02:59,500 --> 00:03:05,360
I looked for an opt-out page, all the big data farms, like everything, Intellisys, all that stuff.

44
00:03:05,900 --> 00:03:10,820
I actually cut those slides out of here because I could have gone on for like three or four slides on things I've opted out of.

45
00:03:10,980 --> 00:03:13,360
If you go on the GitHub, it has all the links in there.

46
00:03:13,440 --> 00:03:15,400
In the slide deck, you can just click them and opt out yourself.

47
00:03:17,660 --> 00:03:22,760
I scrub my social media, but unfortunately, even after you scrub it, they still hold on to that information.

48
00:03:24,020 --> 00:03:25,580
You might not be visible to your friends.

49
00:03:25,960 --> 00:03:28,140
You might not be visible to my tool, but it's still out there.

50
00:03:28,840 --> 00:03:32,640
So what I decided to do was I decided to muddy the water a little bit.

51
00:03:32,760 --> 00:03:33,420
I put a fake name.

52
00:03:33,620 --> 00:03:36,400
I said I was born in 1901, said I was a girl.

53
00:03:36,780 --> 00:03:41,400
You know, you just change everything, and then eventually that muddies the water, and they don't know what's real.

54
00:03:42,260 --> 00:03:47,380
I scrubbed all my old email accounts against Have I Been Pwned?

55
00:03:47,400 --> 00:03:48,180
Have you guys seen that site?

56
00:03:48,680 --> 00:03:49,640
I'm sure a lot of you have.

57
00:03:49,900 --> 00:03:54,040
I put that in there to see if any of my old emails were released at all.

58
00:03:54,260 --> 00:03:55,500
I got rid of old ones.

59
00:03:55,960 --> 00:03:57,660
I registered for the Do Not Call list.

60
00:03:58,100 --> 00:04:04,760
I went through my phone and uninstalled every app that required any weird, wonky permissions.

61
00:04:06,260 --> 00:04:08,240
So that's pretty sanitized at this point.

62
00:04:09,420 --> 00:04:14,580
By the way, if you use the Facebook or Twitter app or the Facebook Messenger, that's like giving them access to your whole phone.

63
00:04:15,800 --> 00:04:17,760
And then I also researched cleanup services.

64
00:04:18,020 --> 00:04:19,680
There's a lot of those on the web, and they're all garbage.

65
00:04:19,720 --> 00:04:20,200
Don't use them.

66
00:04:21,180 --> 00:04:25,660
So I opted out of all the things, and unfortunately, it didn't work.

67
00:04:25,960 --> 00:04:31,640
Six months later, I'm still getting dick enhancement pills, so it doesn't work.

68
00:04:32,300 --> 00:04:33,120
Don't waste your time.

69
00:04:33,280 --> 00:04:34,000
Do the pills still work?

70
00:04:34,300 --> 00:04:34,940
Yeah, both.

71
00:04:35,780 --> 00:04:37,240
Yes, the pills do not work.

72
00:04:37,300 --> 00:04:38,180
Stay away from those.

73
00:04:41,980 --> 00:04:47,260
So I figured maybe I needed a different approach, and then I got this idea.

74
00:04:47,380 --> 00:04:47,880
I said, you know what?

75
00:04:47,900 --> 00:04:54,440
Maybe if I build a tool that does what they do but abuses the data instead of selling it for profit, because that's what a lot of them do,

76
00:04:54,900 --> 00:04:55,940
then maybe we can do it.

77
00:04:55,940 --> 00:04:56,740
Maybe we can fix this problem.

78
00:04:58,180 --> 00:05:00,700
So that's when I started my search for public data.

79
00:05:02,880 --> 00:05:08,700
So public data, as I define it, is data that can be made public either by the local or state or federal governments,

80
00:05:08,940 --> 00:05:13,000
data that can be collected from social media such as Twitter, LinkedIn, and Facebook,

81
00:05:13,340 --> 00:05:18,020
and data that can be collected from APIs like the People API.

82
00:05:18,340 --> 00:05:19,420
Is anybody familiar with the People API?

83
00:05:19,820 --> 00:05:20,140
Sure.

84
00:05:20,360 --> 00:05:22,800
If you're in this room, some of you are probably familiar with it.

85
00:05:22,880 --> 00:05:24,000
It's a really nice tool.

86
00:05:25,000 --> 00:05:25,920
Actually, they recently...

87
00:05:25,940 --> 00:05:26,860
They recently changed their API.

88
00:05:27,120 --> 00:05:29,900
You used to be able to use sample underscore key to get everything.

89
00:05:30,480 --> 00:05:39,740
And in the last week, they updated their API to where you have to actually do a captcha and register a key or to get a new key.

90
00:05:40,040 --> 00:05:41,100
And it's IP-based.

91
00:05:41,340 --> 00:05:49,640
But unfortunately for them, you can just create a fake email account through like Yandex and register and get 30 free trials,

92
00:05:49,720 --> 00:05:50,640
and you can just do that all day.

93
00:05:50,780 --> 00:05:53,020
So it sucks.

94
00:05:53,120 --> 00:05:55,760
They want to offer a free trial, but it doesn't really work.

95
00:05:57,980 --> 00:06:02,120
So government data, as I define it, here's some of the sources that I looked at.

96
00:06:02,200 --> 00:06:03,100
I looked at the voter database.

97
00:06:04,140 --> 00:06:05,100
There's quite a bit in here.

98
00:06:05,180 --> 00:06:07,360
Full name, date of birth, current address, party affiliation.

99
00:06:07,480 --> 00:06:09,580
There's actually 99, about 99 columns.

100
00:06:09,720 --> 00:06:10,760
I put 99 in there.

101
00:06:10,880 --> 00:06:11,840
I think that's what I counted.

102
00:06:12,840 --> 00:06:14,420
There could be more or less by a few.

103
00:06:15,420 --> 00:06:16,040
Property records.

104
00:06:16,260 --> 00:06:23,540
So if you buy a house or, yeah, basically if you buy a house, at least in Ohio, all that information is public.

105
00:06:24,160 --> 00:06:26,040
I'm sure it's the same in most states.

106
00:06:26,760 --> 00:06:27,480
Traffic violations.

107
00:06:27,720 --> 00:06:31,140
If you get a ticket, your information is out there.

108
00:06:31,180 --> 00:06:32,360
Full name, date of birth, current address.

109
00:06:32,540 --> 00:06:36,140
You can just go to the county website and research traffic violations.

110
00:06:37,860 --> 00:06:38,620
Register your pet.

111
00:06:38,740 --> 00:06:39,000
I don't know.

112
00:06:39,080 --> 00:06:44,240
I have a dog and I don't feel like just because I have a dog, my information should be out there.

113
00:06:44,340 --> 00:06:45,220
But apparently it is.

114
00:06:46,300 --> 00:06:47,360
And car registration.

115
00:06:47,480 --> 00:06:48,740
I put a question mark next to this.

116
00:06:48,820 --> 00:06:50,940
I'm hoping somebody that watches this can help me.

117
00:06:51,040 --> 00:06:52,560
I bought a car earlier this year.

118
00:06:53,140 --> 00:06:58,120
And, you know, I'm super conscious about what information I let out there and what I sign up for.

119
00:06:58,460 --> 00:07:03,360
I didn't sign up for anything and I started getting a ton of stuff with my exact car make and model in the mail.

120
00:07:03,500 --> 00:07:08,400
So there must be some type of, yeah, oh, is that what it is?

121
00:07:08,480 --> 00:07:08,700
Okay.

122
00:07:09,220 --> 00:07:16,600
So, yeah, there's some public source out there that people are able to scrape and then offer you, you know, shitty fake warranties.

123
00:07:17,480 --> 00:07:22,360
I would love to incorporate something like that in the future, but I couldn't figure that one out, so I left it out.

124
00:07:22,360 --> 00:07:24,540
These are the ones I didn't use in my tool.

125
00:07:24,820 --> 00:07:35,800
I didn't use the property records, traffic violations, or pet registration mainly because, one, I had all that information that they offered other than the specifics of the traffic violation in the voter database already.

126
00:07:36,100 --> 00:07:49,680
And two, because all of these are very specific to the county, so I would have to write a tool that would scrape every county site individually and I didn't want the state, you know, ishing their pants that I was scraping every county site.

127
00:07:50,180 --> 00:07:52,340
So I ended up going with the Ohio Voter Registration Tool.

128
00:07:52,360 --> 00:07:52,860
So I ended up going with the Ohio Voter Registration Database.

129
00:07:54,600 --> 00:08:04,520
So I spoke with the Secretary of State, CIO, and he told me that these are, that it's a common format across all states.

130
00:08:04,620 --> 00:08:12,540
So theoretically, if you had another state, New York, you know, Nevada, whatever, and you were able to download their database, it would work in my tool.

131
00:08:12,920 --> 00:08:18,760
So I just used Ohio because it made it super easy and they let you download six and a half million records.

132
00:08:18,960 --> 00:08:22,340
In fact, I downloaded the six and a half million a few months ago.

133
00:08:22,360 --> 00:08:31,300
They update this every week, so this is constantly updated with new people that register and stuff, so that's kind of scary.

134
00:08:31,900 --> 00:08:39,260
But yeah, I'll have the links at the, I'll have the links in a blog post afterwards if you guys want to get the links for that.

135
00:08:40,540 --> 00:08:41,480
It's also in the tool.

136
00:08:42,240 --> 00:08:44,460
Here's an example of some of the data that's in the voter database.

137
00:08:45,280 --> 00:08:51,760
So you get voter ID, county number, county ID, first, last, middle, date of birth, registration date, voter status, all types of stuff.

138
00:08:51,940 --> 00:08:52,340
There's a lot.

139
00:08:52,360 --> 00:08:54,460
There's a lot of fun things you can do with just the database.

140
00:08:55,280 --> 00:09:01,060
You can search for young people near me and then filter out young women and then be a predator.

141
00:09:01,260 --> 00:09:08,940
Or you can search for elderly people for me and, you know, go around and fish their, you know, Social Security checks out of their mailbox.

142
00:09:09,180 --> 00:09:10,240
I know that's been a problem for a while.

143
00:09:10,360 --> 00:09:12,920
So just with the voter database, you can do that kind of stuff.

144
00:09:14,320 --> 00:09:17,620
I don't condone that, but, you know, that's what they're putting out there.

145
00:09:18,000 --> 00:09:20,940
So now that we have our seed data, we can start getting the personal data.

146
00:09:21,720 --> 00:09:32,000
Some of the sources of personal data that I looked at was Facebook, which offers a slew of things, interests, current city-state, original city-state, relationships, degree, and schools attended, and jobs.

147
00:09:33,240 --> 00:09:35,660
Twitter, I tried to find a way to correlate to this.

148
00:09:35,740 --> 00:09:39,780
I really did, but it's like people put, I put random shit on there.

149
00:09:39,860 --> 00:09:41,100
I don't even use my real name half the time.

150
00:09:41,240 --> 00:09:43,400
So, like, current thoughts, I don't know.

151
00:09:45,200 --> 00:09:46,680
LinkedIn, that's a wealth of information.

152
00:09:46,760 --> 00:09:48,120
I'm actually going to write a plug-in for that.

153
00:09:48,580 --> 00:09:50,140
I just didn't have time to do it for DEF CON.

154
00:09:50,140 --> 00:09:51,320
I'll have it done for Derby CON.

155
00:09:52,380 --> 00:09:54,360
The People API, it's everything.

156
00:09:54,800 --> 00:09:57,100
If you've seen the People API, you know that.

157
00:09:57,220 --> 00:09:58,700
If not, it has, like, phone numbers.

158
00:09:58,840 --> 00:09:59,880
I'll demonstrate it here in a minute.

159
00:09:59,960 --> 00:10:05,740
It has phone numbers and relationships and every address you've lived at, every name, every alias you've gone by.

160
00:10:06,600 --> 00:10:07,480
And then Instagram.

161
00:10:07,760 --> 00:10:13,360
You know, I didn't incorporate Instagram, but in some of my early research, I actually did it in a blog post.

162
00:10:13,580 --> 00:10:20,120
I was able to extract some detailed information about a target just from Instagram based on, like, where they're from.

163
00:10:20,120 --> 00:10:26,500
Where they like to go shop and where they like to eat and some of the social activities they're involved in, like jazz band and soccer and where they played at.

164
00:10:27,040 --> 00:10:28,140
Just based on Instagram.

165
00:10:28,400 --> 00:10:30,420
So, that's also a great target.

166
00:10:31,840 --> 00:10:34,080
So, now we're going to look into scraping Facebook.

167
00:10:35,700 --> 00:10:39,700
A couple things to know about scraping Facebook is, one, it is a violation of their terms of service.

168
00:10:39,820 --> 00:10:41,420
So, if you get caught doing it, they will ban you.

169
00:10:42,000 --> 00:10:43,920
They didn't ban me yet, but I'm using a fake profile.

170
00:10:44,140 --> 00:10:45,860
So, good luck.

171
00:10:47,260 --> 00:10:49,880
And then, also, their data comes back.

172
00:10:50,120 --> 00:10:52,120
When you try and scrape it, they do some things to try and...

173
00:10:52,120 --> 00:10:54,200
I'm sure it wasn't to try and mitigate people scraping.

174
00:10:54,340 --> 00:10:54,840
Maybe it was.

175
00:10:55,180 --> 00:10:58,700
But they do some things that make it a little more difficult to scrape.

176
00:10:59,080 --> 00:11:00,380
Does anybody know what Ajax is?

177
00:11:00,880 --> 00:11:02,900
I don't know if we have any developers, any engineers in the room.

178
00:11:03,040 --> 00:11:05,080
So, Ajax will...

179
00:11:05,080 --> 00:11:06,960
It kind of speeds up the way the page loads.

180
00:11:07,100 --> 00:11:08,040
It's like a trick to the eye.

181
00:11:08,940 --> 00:11:10,800
So, the page will load and it will be a container.

182
00:11:11,200 --> 00:11:15,660
And then, as that container loads, it will go out and make another request for the actual data.

183
00:11:16,560 --> 00:11:18,220
So, if you're trying to scrape...

184
00:11:19,000 --> 00:11:22,180
A lot of tools will just get you that container and you won't get the actual data.

185
00:11:23,680 --> 00:11:26,680
So, it makes it a little more challenging, but I found ways around it.

186
00:11:26,780 --> 00:11:27,800
It's not too hard.

187
00:11:28,620 --> 00:11:31,640
Facebook elements can be scraped by focusing on automation strings.

188
00:11:31,820 --> 00:11:33,060
Does anybody know what an automation string is?

189
00:11:34,640 --> 00:11:38,480
So, Facebook, like any other big company, they want to be able to test their software.

190
00:11:39,460 --> 00:11:42,640
So, they put these little ID tags on every element.

191
00:11:43,040 --> 00:11:47,640
And then, they're able to write other programs that look through the page

192
00:11:47,640 --> 00:11:48,520
for those IDs.

193
00:11:49,200 --> 00:11:52,020
And then, they can put in fake data or put in real data.

194
00:11:52,180 --> 00:11:52,980
And they can check values.

195
00:11:53,940 --> 00:11:55,800
And they leave that in their production environment.

196
00:11:56,020 --> 00:11:57,720
So, we're able to use that to scrape with.

197
00:11:57,840 --> 00:12:01,100
We can say, go get me all of the info fields.

198
00:12:01,400 --> 00:12:04,780
And you can get their work, you know, where they work and their education and all that stuff.

199
00:12:05,560 --> 00:12:08,220
And that's the technique I'm going to show here in a second.

200
00:12:10,160 --> 00:12:11,540
Also, I use multi-pass scraping.

201
00:12:11,680 --> 00:12:12,320
It makes it a little bit easier.

202
00:12:12,480 --> 00:12:13,980
So, I'll go through it multiple times.

203
00:12:15,840 --> 00:12:17,620
So, one thing to note real quick about Facebook.

204
00:12:17,640 --> 00:12:19,740
Facebook is this query right here.

205
00:12:20,480 --> 00:12:21,560
Search slash people.

206
00:12:22,160 --> 00:12:24,620
And then, the little Q is the query.

207
00:12:28,360 --> 00:12:32,800
So, unauthenticated, I've only noticed that you'll get prompted with a captcha once.

208
00:12:33,080 --> 00:12:34,220
It may be more than that.

209
00:12:34,300 --> 00:12:36,020
I've run this thousands and thousands of times.

210
00:12:36,780 --> 00:12:40,700
If you're authenticated, though, you can run this endlessly without a captcha ever.

211
00:12:40,860 --> 00:12:45,380
So, if you create a fake Facebook account, you can just run this query over and over and over again.

212
00:12:45,820 --> 00:12:47,500
And what's fun about it is,

213
00:12:47,640 --> 00:12:49,000
I can search for John Smith in Ohio.

214
00:12:49,440 --> 00:12:52,940
And it'll go get me everybody in Ohio that their name is John Smith.

215
00:12:54,420 --> 00:12:55,540
It works really well.

216
00:12:57,440 --> 00:12:59,020
So, here's an example of that.

217
00:12:59,420 --> 00:13:00,360
This is what it'll return.

218
00:13:00,560 --> 00:13:04,280
And what the tool does and what we want to do is we want to get the links out of here.

219
00:13:04,560 --> 00:13:06,660
Because, obviously, the names are hyperlinks.

220
00:13:06,720 --> 00:13:07,540
So, we want to grab those.

221
00:13:09,260 --> 00:13:10,200
So, how do we do that?

222
00:13:11,500 --> 00:13:13,520
Well, these are the tools that I tried to do that with.

223
00:13:13,600 --> 00:13:15,900
I tried using curl and wget and links.

224
00:13:15,900 --> 00:13:20,740
Because I really didn't want to write this in anything that I couldn't run in the terminal.

225
00:13:20,980 --> 00:13:22,840
But, unfortunately, that didn't happen.

226
00:13:24,180 --> 00:13:25,780
I tried the WPF web browser.

227
00:13:26,480 --> 00:13:27,780
It wasn't very...

228
00:13:27,780 --> 00:13:29,780
It was limited on function calls.

229
00:13:30,680 --> 00:13:32,400
So, I ended up going with the WinForms browser.

230
00:13:33,300 --> 00:13:35,220
Fun thing about WinForms browser.

231
00:13:35,600 --> 00:13:38,880
It has a memory leak in the...

232
00:13:39,500 --> 00:13:41,940
You know when you have your browser open and you have the back button?

233
00:13:42,680 --> 00:13:45,100
Well, it keeps a log of everything that you've done.

234
00:13:45,100 --> 00:13:50,740
Well, when you navigate like 10,000 times, that back button doesn't empty out ever.

235
00:13:50,860 --> 00:13:53,160
Like the history cache doesn't ever empty out.

236
00:13:53,340 --> 00:13:54,860
And it took me forever to figure this out.

237
00:13:54,980 --> 00:13:56,420
But, yeah, there's a memory leak in there.

238
00:13:56,520 --> 00:13:59,280
So, what I had to do was I wrote a separate application.

239
00:13:59,640 --> 00:14:02,580
Then all it did was take a URL as a command parameter.

240
00:14:02,700 --> 00:14:03,920
And then it dumped the source out.

241
00:14:04,140 --> 00:14:07,320
And then in my application, I just spin up one instance of it.

242
00:14:07,420 --> 00:14:09,200
Get the source and then close it.

243
00:14:09,280 --> 00:14:10,920
And then that kind of solved the memory leak issue.

244
00:14:11,060 --> 00:14:12,380
But they're never going to fix that.

245
00:14:12,500 --> 00:14:14,020
So, that was my workaround.

246
00:14:15,660 --> 00:14:16,380
Here's an example.

247
00:14:16,460 --> 00:14:17,540
Does anybody know what a regex is?

248
00:14:18,540 --> 00:14:19,720
Regexes are kind of like magic.

249
00:14:20,340 --> 00:14:22,120
You really shouldn't use them for web scraping.

250
00:14:22,280 --> 00:14:24,040
But, you know, why not?

251
00:14:24,100 --> 00:14:24,680
It's a hacker conference.

252
00:14:25,940 --> 00:14:30,280
So, this is a really basic example of the regex that I use over and over and over again.

253
00:14:30,380 --> 00:14:31,720
I am not a regex pro.

254
00:14:34,860 --> 00:14:36,360
I'm really not a regex pro.

255
00:14:36,460 --> 00:14:36,940
Not at all.

256
00:14:38,060 --> 00:14:39,260
But this is the example.

257
00:14:39,420 --> 00:14:40,460
So, there's three parts to it.

258
00:14:40,600 --> 00:14:44,100
I use a positive look behind, which I'll show you what each of these mean here in a second.

259
00:14:44,100 --> 00:14:45,700
I use a positive look behind.

260
00:14:46,040 --> 00:14:51,160
I match zero to unlimited with, and I make it lazy so it grabs just the minimum amount.

261
00:14:51,420 --> 00:14:52,740
And then I use a positive look ahead.

262
00:14:53,500 --> 00:14:55,280
And this is what it actually looks like.

263
00:14:55,380 --> 00:14:56,880
So, this is the positive look behind.

264
00:14:57,300 --> 00:14:59,140
And you see that pink little dot right there?

265
00:14:59,680 --> 00:15:03,780
That's saying that, okay, this is where we're going to start.

266
00:15:06,000 --> 00:15:10,400
And then when we add in the period asterisk, it grabs everything to the end of the line.

267
00:15:12,220 --> 00:15:13,460
And then I add a question mark.

268
00:15:14,100 --> 00:15:15,720
I make it lazy so it grabs as few as possible.

269
00:15:17,680 --> 00:15:26,320
And then I add the positive look ahead, which you can't see it, but it's marking the end there by the less than symbol and the forward slash.

270
00:15:26,640 --> 00:15:33,920
So, ultimately what that does, that regex will do, is it will go through, and everything that matches that regex, it will grab me the text for it.

271
00:15:36,800 --> 00:15:39,680
So, that's how I use to get actually all the information.

272
00:15:40,080 --> 00:15:44,000
Here's an example of how I grab the URLs off of the search.

273
00:15:44,000 --> 00:15:44,700
The query page.

274
00:15:46,240 --> 00:15:49,900
So, I use the, I'm not going to go too deep into this because it's kind of crazy.

275
00:15:50,040 --> 00:15:53,540
But right here, you can see the data test ID.

276
00:15:54,160 --> 00:15:56,000
This is something they would use to be testing with.

277
00:15:56,240 --> 00:15:57,620
I'm guessing this is their automation ID.

278
00:15:57,740 --> 00:15:58,040
I don't know.

279
00:15:58,140 --> 00:15:58,540
Maybe not.

280
00:15:59,200 --> 00:16:01,540
But it was unique, so I used that.

281
00:16:02,380 --> 00:16:04,980
And it grabs the center part right here.

282
00:16:06,220 --> 00:16:08,660
You can see there's the data test ID SERP result.

283
00:16:08,800 --> 00:16:10,120
This is actually, this is the real code.

284
00:16:11,920 --> 00:16:13,940
And then, you know, I look for div.

285
00:16:14,000 --> 00:16:15,220
A-H-R-E-F.

286
00:16:15,460 --> 00:16:16,660
So, div.

287
00:16:16,920 --> 00:16:17,920
A-H-R-E-F.

288
00:16:18,160 --> 00:16:21,000
And then, that would be where the pink line is right there.

289
00:16:23,000 --> 00:16:24,460
So, this is the target information.

290
00:16:24,760 --> 00:16:26,520
This is what I want to grab off of a profile.

291
00:16:27,020 --> 00:16:32,420
And, I mean, if I'm doing this with an unknown amount of profiles for unknown people, you've got to use regex.

292
00:16:34,260 --> 00:16:39,300
So, I use something I like to refer to as multi-pass regex scraping.

293
00:16:40,820 --> 00:16:42,440
So, I'll grab all the source.

294
00:16:42,680 --> 00:16:43,920
And then, I'll get chunks.

295
00:16:44,000 --> 00:16:44,960
Chunks out of what I want.

296
00:16:45,060 --> 00:16:46,920
And then, I'll run regexes over those chunks.

297
00:16:47,500 --> 00:16:51,860
So, I use three passes to get the profile information.

298
00:16:52,060 --> 00:16:56,220
This is like where the person worked and where they studied and things like that.

299
00:16:57,540 --> 00:16:59,240
So, real quick, here's the first pass.

300
00:16:59,360 --> 00:17:00,760
The first pass will get everything in blue.

301
00:17:00,900 --> 00:17:05,040
Now, the blue is, this is each of those blocks.

302
00:17:05,260 --> 00:17:07,680
So, you can see the first one says it's their high school.

303
00:17:07,840 --> 00:17:10,520
And the second one says it's the electronic classroom tomorrow.

304
00:17:10,780 --> 00:17:13,840
And the third one is it's probably their location, where they're from.

305
00:17:14,780 --> 00:17:16,520
And that's ultimately what I want to get.

306
00:17:16,720 --> 00:17:19,520
So, right now, I have the blue chunks.

307
00:17:21,280 --> 00:17:23,080
So, then we run another regex over it.

308
00:17:23,340 --> 00:17:25,660
And this regex cuts it down even more.

309
00:17:26,020 --> 00:17:28,780
And, as you can see, we still have our data in here that we're trying to abstract.

310
00:17:29,240 --> 00:17:30,560
But we have a lot less.

311
00:17:30,920 --> 00:17:32,900
So, this is the second chunk that we have now.

312
00:17:35,640 --> 00:17:37,940
And then, finally, in the last chunk, it's really easy.

313
00:17:38,120 --> 00:17:43,560
We just look for the, let's see, we look for the greater than symbol right there.

314
00:17:43,560 --> 00:17:46,520
And there's only one greater than symbol in the chunk.

315
00:17:46,640 --> 00:17:47,780
So, it's easy to grab the data.

316
00:17:48,420 --> 00:17:50,660
And then, I add that to a list in the application.

317
00:17:50,980 --> 00:17:51,960
And we can use that for analysis.

318
00:17:53,320 --> 00:17:57,500
So, now that we have it, let's start analyzing it and figuring out if we have our target.

319
00:18:00,560 --> 00:18:01,980
So, I'm going to use a different example.

320
00:18:02,080 --> 00:18:03,020
This is actually a full example.

321
00:18:03,360 --> 00:18:04,240
And this is real data.

322
00:18:04,380 --> 00:18:05,940
So, please don't harass this person.

323
00:18:07,640 --> 00:18:09,860
So, I'm going to use a result from the voter database.

324
00:18:11,080 --> 00:18:13,540
And then, I'm going to look at a series of Facebook profiles.

325
00:18:13,560 --> 00:18:15,120
That could possibly be that person.

326
00:18:15,260 --> 00:18:18,480
And we're going to try and match them up to find the actual person.

327
00:18:19,380 --> 00:18:20,560
So, this is our target.

328
00:18:21,140 --> 00:18:22,800
Her name is Samantha Adkins.

329
00:18:23,100 --> 00:18:23,560
She's 18.

330
00:18:23,800 --> 00:18:24,820
She's from Lakewood, Ohio.

331
00:18:26,220 --> 00:18:29,880
I got this just by querying for 18-year-olds in Lakewood.

332
00:18:30,000 --> 00:18:31,720
And I found one on a street.

333
00:18:32,900 --> 00:18:33,960
There were a number of results.

334
00:18:34,100 --> 00:18:35,120
But you can do this in any city.

335
00:18:35,180 --> 00:18:36,560
And you should be able to do this with any state.

336
00:18:37,520 --> 00:18:41,860
And then, I ran that query, our Facebook query, for Samantha Adkins.

337
00:18:41,860 --> 00:18:43,140
The plus symbols are just spaces.

338
00:18:43,400 --> 00:18:44,580
A lot of devs know that.

339
00:18:44,620 --> 00:18:45,800
But if you're not a dev, that's all it is.

340
00:18:45,880 --> 00:18:46,420
It's just a space.

341
00:18:46,740 --> 00:18:48,920
I think you can use %20 in this, too.

342
00:18:48,980 --> 00:18:49,540
I think that'll work.

343
00:18:50,640 --> 00:18:51,180
It should.

344
00:18:52,420 --> 00:18:53,960
But these are the results we got.

345
00:18:55,140 --> 00:18:58,220
Each of these is a profile that we scraped off the page using those regexes.

346
00:19:00,120 --> 00:19:02,500
And now, we want to dig into each of those profiles.

347
00:19:02,680 --> 00:19:04,580
And we want to see if that's our person.

348
00:19:04,680 --> 00:19:05,920
So, we've got to scrape the details off.

349
00:19:06,320 --> 00:19:08,360
So, we're assuming we're scraping the details off.

350
00:19:09,000 --> 00:19:11,480
This is actually kind of super arbitrary.

351
00:19:11,860 --> 00:19:12,240
I don't know if you...

352
00:19:12,240 --> 00:19:14,780
Did anybody read the 2600 article I wrote?

353
00:19:15,500 --> 00:19:15,800
Yeah.

354
00:19:16,420 --> 00:19:16,780
Okay.

355
00:19:16,820 --> 00:19:19,420
So, this is super arbitrary.

356
00:19:19,680 --> 00:19:20,000
All right.

357
00:19:20,040 --> 00:19:24,000
I messed with the scores until I got back really good results.

358
00:19:24,440 --> 00:19:29,600
So, if somebody way smarter than me, which is probably everybody, can come up with something better,

359
00:19:29,640 --> 00:19:30,260
please let me know.

360
00:19:30,300 --> 00:19:33,380
I would love to actually have a really good algorithm for this.

361
00:19:33,520 --> 00:19:35,720
But I look at the profile.

362
00:19:35,920 --> 00:19:38,540
And I say, okay, if the first name exists, they get .15.

363
00:19:38,880 --> 00:19:40,160
If the last name exists, they get .15.

364
00:19:40,160 --> 00:19:43,760
And then one of these three cases down here will be true.

365
00:19:43,840 --> 00:19:46,220
Either the city and state will be found and they'll get .7.

366
00:19:46,600 --> 00:19:48,460
Or just the state is found and they get .1.

367
00:19:48,500 --> 00:19:50,220
Or just the city is found and they get .4.

368
00:19:51,080 --> 00:19:52,940
And then that builds a confidence score.

369
00:19:53,500 --> 00:19:56,280
And we're able to identify targets with it.

370
00:19:56,560 --> 00:20:03,940
So, as you can see, all those profiles, we have .41, .41, .41, .42, .43, and then 1.02.

371
00:20:04,740 --> 00:20:06,760
So, that is a really strong match.

372
00:20:07,240 --> 00:20:10,140
And if we look at it, you can see that...

373
00:20:10,160 --> 00:20:12,860
Samantha Atkins from Lakewood, Ohio.

374
00:20:13,560 --> 00:20:15,700
And this is very likely our target.

375
00:20:19,380 --> 00:20:22,460
So, based on this, what do we know about our target now?

376
00:20:22,600 --> 00:20:23,840
So, we have her full legal name.

377
00:20:23,920 --> 00:20:24,560
We have her home address.

378
00:20:24,740 --> 00:20:25,420
We have her date of birth.

379
00:20:25,520 --> 00:20:26,200
We have photos of her.

380
00:20:26,280 --> 00:20:26,840
We know her interests.

381
00:20:27,160 --> 00:20:28,560
We have her relationship status.

382
00:20:28,780 --> 00:20:30,840
We know who her partner is.

383
00:20:31,340 --> 00:20:32,560
And a slew of other information.

384
00:20:34,620 --> 00:20:36,020
But we can actually do more than that.

385
00:20:36,080 --> 00:20:36,680
We can do a lot more.

386
00:20:37,080 --> 00:20:38,220
That was a simple example.

387
00:20:38,480 --> 00:20:39,520
That was something that...

388
00:20:39,520 --> 00:20:42,400
That was originally what I wanted to demo as my project.

389
00:20:43,020 --> 00:20:46,060
But then I started thinking, you know, like a bad guy.

390
00:20:46,160 --> 00:20:49,660
And I said, well, you know, what if I really wanted to do damage with this?

391
00:20:50,220 --> 00:20:54,200
It's one thing to be able to walk down the road and say, oh, yeah, you know, so-and-so lives there.

392
00:20:54,680 --> 00:21:04,000
But, you know, what if we started with Facebook and used their search tools and then worked backwards and try and resolve, you know, people that way?

393
00:21:05,400 --> 00:21:08,820
So, you know, what if we search for people that work for things like the USPS?

394
00:21:08,820 --> 00:21:10,740
Or the Cleveland Police Department?

395
00:21:11,220 --> 00:21:12,900
Or the Cleveland Fire Department?

396
00:21:13,160 --> 00:21:14,840
Or the Perinuclear Power Plant?

397
00:21:15,260 --> 00:21:16,720
Or the Ohio National Guard?

398
00:21:17,160 --> 00:21:18,720
Or one of other...

399
00:21:18,720 --> 00:21:25,900
One of another million, you know, possible, you know, places that people would probably not want you to know they live.

400
00:21:27,220 --> 00:21:29,880
So I'm going to demo a tool that I've been working on.

401
00:21:30,040 --> 00:21:32,760
It's definitely not a final tool yet.

402
00:21:32,820 --> 00:21:34,000
I'm going to keep working on it.

403
00:21:35,440 --> 00:21:35,960
But...

404
00:21:37,940 --> 00:21:38,740
Let's see here.

405
00:21:38,740 --> 00:21:40,580
You probably won't be able to see some of the text.

406
00:21:40,700 --> 00:21:40,960
It's okay.

407
00:21:41,160 --> 00:21:41,980
That's not important.

408
00:21:42,840 --> 00:21:46,020
The first thing I'm going to demo is the database searching.

409
00:21:47,300 --> 00:21:50,640
So with this, this is just...

410
00:21:50,640 --> 00:21:52,380
I mean, it's just an interface to the database.

411
00:21:52,740 --> 00:21:56,640
I'm going to search for people that were born after 1998.

412
00:21:58,220 --> 00:22:00,760
We're going to choose a street here.

413
00:22:04,040 --> 00:22:04,720
All right.

414
00:22:04,780 --> 00:22:05,560
I'm going to hit search.

415
00:22:05,580 --> 00:22:06,520
And hopefully it works.

416
00:22:08,880 --> 00:22:09,640
I have videos.

417
00:22:09,740 --> 00:22:10,480
If it doesn't work, don't worry.

418
00:22:11,640 --> 00:22:13,160
The Wi-Fi is kind of wonky.

419
00:22:13,300 --> 00:22:18,220
So what it's doing is it's searching a database that I have recreated in Azure.

420
00:22:19,940 --> 00:22:23,260
I downloaded it from the Ohio Secretary of State website.

421
00:22:23,860 --> 00:22:25,900
And as you see here, we get a number of results.

422
00:22:27,100 --> 00:22:31,880
And these are all people that are right around 18 that live on...

423
00:22:33,440 --> 00:22:36,540
That live on Clifton in Lakewood, Ohio.

424
00:22:37,520 --> 00:22:38,720
So I pulled...

425
00:22:38,720 --> 00:22:42,620
I made a couple notes here because I didn't want to accidentally show, like, minors and things.

426
00:22:42,760 --> 00:22:46,880
So I'm going to use Julia Alvarez here.

427
00:22:47,080 --> 00:22:47,600
Let's try her.

428
00:22:48,440 --> 00:22:51,940
So this is the application opening up, spawning a browser.

429
00:22:52,160 --> 00:22:53,340
And now it's searching Facebook.

430
00:22:53,700 --> 00:22:55,520
There must be two profiles that came back.

431
00:22:55,900 --> 00:23:00,480
And as you can see, Julia Alvarez came back with a score of 1.04.

432
00:23:01,720 --> 00:23:07,640
And if we visit the page, that's Julia Alvarez from Lakewood, Ohio, Lakewood High School.

433
00:23:08,220 --> 00:23:09,660
So we have all this information.

434
00:23:09,920 --> 00:23:14,080
And in a matter of seconds, we've managed to find an 18-year-old that lives on a street.

435
00:23:14,280 --> 00:23:15,180
It could be your street.

436
00:23:15,580 --> 00:23:17,460
And we know their personal information.

437
00:23:17,820 --> 00:23:19,820
We have a Facebook link to it.

438
00:23:20,840 --> 00:23:23,420
So that was originally what the project was about.

439
00:23:23,540 --> 00:23:24,140
But then I would...

440
00:23:24,140 --> 00:23:25,480
You know, that was kind of easy to do.

441
00:23:25,580 --> 00:23:26,640
So I wanted to go a little bit further.

442
00:23:28,340 --> 00:23:29,480
So this is...

443
00:23:29,480 --> 00:23:29,980
You probably...

444
00:23:29,980 --> 00:23:32,540
If anybody uses Facebook, you'll recognize this is the Find Friends page.

445
00:23:32,840 --> 00:23:34,480
I just embedded it right in my application.

446
00:23:34,920 --> 00:23:37,620
And you'll notice over here on the right, they have the Search for Friends.

447
00:23:37,620 --> 00:23:42,220
The Search for Friends search criteria.

448
00:23:42,600 --> 00:23:47,920
So I'm going to search for something like perinuclear power.

449
00:23:49,200 --> 00:23:54,160
If you don't know, perinuclear power plant is a nuclear power plant in the state of Ohio.

450
00:23:56,500 --> 00:23:59,240
And people register it as their workplace.

451
00:23:59,740 --> 00:24:01,020
That's critical infrastructure.

452
00:24:01,600 --> 00:24:06,780
Nuclear power plants have been in the news recently as targets of opportunity for foreign agents.

453
00:24:07,800 --> 00:24:12,400
For phishing campaigns, trying to get credentials, identity theft, a number of other things.

454
00:24:14,160 --> 00:24:15,940
So I've got my results here.

455
00:24:16,040 --> 00:24:19,660
I'm going to click this button up here at the top that says click here to import into Alohomora.

456
00:24:20,500 --> 00:24:22,120
And we get this result back.

457
00:24:22,260 --> 00:24:24,040
So these are all the people over here on the left.

458
00:24:24,680 --> 00:24:26,060
And we can just...

459
00:24:26,480 --> 00:24:27,260
Let's choose this guy.

460
00:24:28,400 --> 00:24:30,320
And let's scrape his Facebook information.

461
00:24:31,920 --> 00:24:33,760
So that pulls down his Facebook information.

462
00:24:34,000 --> 00:24:35,540
Jason Weeks from Ashtabula, Ohio.

463
00:24:36,200 --> 00:24:37,020
It's a little broken.

464
00:24:37,020 --> 00:24:39,660
So a quick story about the jobs thing up here.

465
00:24:40,020 --> 00:24:45,780
I was trying to actually break down the different details confidently, like what they were.

466
00:24:46,140 --> 00:24:49,700
And I had the bright idea to use the ID of the image.

467
00:24:49,880 --> 00:24:54,720
Because if you look at the Facebook profile, like we can open it up here and I can take a look.

468
00:24:54,900 --> 00:24:59,560
So if we look at Jason Weeks' profile here, you can see the little suitcase.

469
00:25:00,080 --> 00:25:02,660
I said, oh, well, those images are probably unique.

470
00:25:02,900 --> 00:25:06,700
I wonder if I could just use the ID of those images and know that what's in that column is a job.

471
00:25:07,440 --> 00:25:08,700
But it keeps breaking.

472
00:25:08,880 --> 00:25:11,940
I think they're changing the IDs randomly every so often.

473
00:25:13,020 --> 00:25:14,460
So I have to figure out a way around that.

474
00:25:14,580 --> 00:25:18,060
But the good news is we still have all the details and we can still use it.

475
00:25:18,860 --> 00:25:20,440
So we just scraped his information.

476
00:25:20,480 --> 00:25:23,780
We see that he works at a perinuclear power plant.

477
00:25:24,020 --> 00:25:24,880
He was in the Navy.

478
00:25:25,280 --> 00:25:26,540
We see what school he went to.

479
00:25:26,640 --> 00:25:30,340
We also see his girlfriend or wife's name, his spouse's name.

480
00:25:30,800 --> 00:25:34,300
We can search the voter database and see if there's any information there on them.

481
00:25:35,720 --> 00:25:37,600
And that should bring back a result.

482
00:25:43,100 --> 00:25:47,200
So as you can see, we get his home address now and his age.

483
00:25:47,620 --> 00:25:50,400
And then I also built in a module for the people API.

484
00:25:51,300 --> 00:25:53,180
And I tested it this morning, so I hope it works.

485
00:25:53,320 --> 00:25:53,600
Okay.

486
00:25:54,080 --> 00:25:57,900
We get a bunch of results back for the different people.

487
00:25:58,080 --> 00:25:59,420
Now, we would have to dig through this.

488
00:25:59,860 --> 00:26:03,520
It depends on the person that you're pulling back, whether or not it's him.

489
00:26:03,520 --> 00:26:04,260
I don't think that's him.

490
00:26:06,980 --> 00:26:10,700
It depends on the person you're pulling back on what information you get.

491
00:26:11,920 --> 00:26:13,700
This one has been kind of wonky.

492
00:26:13,820 --> 00:26:18,280
I don't know if people's messing with me or not because I've searched this guy like a million times at this point.

493
00:26:18,420 --> 00:26:22,960
So I don't know if they're just trying to like send me back a ton of results.

494
00:26:23,540 --> 00:26:24,880
We can use this lady here.

495
00:26:24,980 --> 00:26:26,320
I think she comes back pretty well.

496
00:26:26,820 --> 00:26:27,860
This is another one.

497
00:26:29,820 --> 00:26:31,140
So obviously that's not her.

498
00:26:31,220 --> 00:26:31,880
That's probably her son.

499
00:26:31,880 --> 00:26:34,240
But she also works at PeriNuclear Power Plant.

500
00:26:37,000 --> 00:26:38,140
Yeah, that's her last name.

501
00:26:38,300 --> 00:26:39,800
So let's go ahead and search the voter database.

502
00:26:40,860 --> 00:26:42,320
See if that brings anything back.

503
00:26:44,700 --> 00:26:48,740
We can also search the people API and see if anything returns from that.

504
00:26:48,980 --> 00:26:56,080
But I guess the point that I'm trying to make with this is that so that's probably her right there.

505
00:26:57,340 --> 00:26:57,740
Yeah.

506
00:26:57,820 --> 00:27:00,620
So as you can see, she's got a picture of her son in there.

507
00:27:00,620 --> 00:27:08,320
We can definitely extract a ton of information using these methods.

508
00:27:08,900 --> 00:27:10,640
Now, like I said, this is just a demo.

509
00:27:10,760 --> 00:27:16,100
This isn't something that I meant to put in here as a tool that I want people to go use.

510
00:27:16,460 --> 00:27:28,960
I'm just trying to highlight a point that with these methods, we can build detailed target profiles for phishing campaigns or for identity theft for a number of things that are nefarious.

511
00:27:29,160 --> 00:27:29,400
Okay.

512
00:27:31,520 --> 00:27:33,640
So Mr. Shelton here.

513
00:27:34,100 --> 00:27:35,600
See if we can get his home address.

514
00:27:39,960 --> 00:27:41,020
I don't think that's him.

515
00:27:43,040 --> 00:27:44,600
But we would be able to find him.

516
00:27:44,640 --> 00:27:45,080
He's in here.

517
00:27:49,240 --> 00:27:49,860
That's not him.

518
00:27:51,360 --> 00:27:53,100
But the point is we can do it.

519
00:27:54,800 --> 00:27:56,860
So let's head back over to the slides really quick.

520
00:27:59,660 --> 00:28:00,240
All right.

521
00:28:00,260 --> 00:28:00,540
So.

522
00:28:00,620 --> 00:28:01,800
Who cares?

523
00:28:02,100 --> 00:28:06,940
Well, I would hope that these people that I presented today care for one.

524
00:28:07,600 --> 00:28:13,520
I know that when I was in the military, especially when I was stateside, I was a police officer.

525
00:28:13,720 --> 00:28:18,440
I did not want anybody knowing where I lived for obvious reasons.

526
00:28:18,660 --> 00:28:18,760
Right.

527
00:28:18,880 --> 00:28:24,240
You know, if you give somebody a DUI, you don't want them to be able to figure out where you live and come firebomb your house.

528
00:28:24,340 --> 00:28:25,300
That's probably not a good thing.

529
00:28:25,640 --> 00:28:28,800
Or have your phone numbers and harass you or one of a million scenarios.

530
00:28:29,960 --> 00:28:31,060
That's just the local stuff.

531
00:28:31,180 --> 00:28:33,900
What about the critical infrastructure, the nuclear power plant?

532
00:28:34,000 --> 00:28:35,480
We saw the details we can get from that.

533
00:28:35,660 --> 00:28:40,700
I don't want foreign agents being able to fish critical infrastructure.

534
00:28:41,060 --> 00:28:42,240
Like, that shouldn't be a thing.

535
00:28:42,680 --> 00:28:43,400
But it is.

536
00:28:44,580 --> 00:28:45,160
What else?

537
00:28:45,640 --> 00:28:46,960
I mean, plotting troop movements.

538
00:28:47,020 --> 00:28:49,140
So we can do that with the National Guard and the Army.

539
00:28:49,220 --> 00:28:52,080
We can figure out where our troops are, figure out where their families live.

540
00:28:52,560 --> 00:28:53,960
Does anybody know what FRG is?

541
00:28:55,140 --> 00:28:55,500
Anybody?

542
00:28:56,900 --> 00:28:58,400
Raise your hand if you know what FRG is.

543
00:28:59,040 --> 00:28:59,720
No one?

544
00:28:59,860 --> 00:29:00,480
All right.

545
00:29:01,100 --> 00:29:03,420
I was trying to weed out the feds.

546
00:29:03,420 --> 00:29:03,800
All right.

547
00:29:04,160 --> 00:29:05,480
FRG is Family Readiness Group.

548
00:29:05,620 --> 00:29:07,260
I wanted to save this story.

549
00:29:07,380 --> 00:29:09,240
So FRG is Family Readiness Group.

550
00:29:09,360 --> 00:29:14,920
When I was in the military, they're like the Army spouses that stay back.

551
00:29:15,280 --> 00:29:17,440
Or the military spouses that stay back, I should say.

552
00:29:17,840 --> 00:29:21,200
And they form together and they provide information to each other and support.

553
00:29:21,480 --> 00:29:22,180
They're a really great group.

554
00:29:22,740 --> 00:29:26,260
But when I went overseas, unfortunately, there was a miscommunication.

555
00:29:26,680 --> 00:29:28,380
The FRG really shouldn't be contacted.

556
00:29:28,400 --> 00:29:33,080
We were contacting family members of soldiers and telling them about firefights and things.

557
00:29:33,560 --> 00:29:36,280
Well, we had a firefight and we were on blackout.

558
00:29:36,340 --> 00:29:38,120
We weren't able to communicate outside of the base.

559
00:29:38,340 --> 00:29:40,760
And the FRG went and called my family.

560
00:29:40,860 --> 00:29:43,740
They called my mom and told her there was a bloodbath and all these types of stuff.

561
00:29:44,020 --> 00:29:46,480
And my mom was freaking out and I had no idea.

562
00:29:46,740 --> 00:29:48,360
And I was on blackout.

563
00:29:48,400 --> 00:29:48,920
We were on blackout.

564
00:29:48,960 --> 00:29:50,200
We couldn't call anybody for weeks.

565
00:29:51,980 --> 00:29:57,400
So, yeah, it's not a good thing to be able to contact your family.

566
00:29:57,400 --> 00:29:59,440
Contact the family of soldiers to be able to get information.

567
00:29:59,760 --> 00:30:01,460
I want that information secured.

568
00:30:05,060 --> 00:30:07,900
So, who cares about this data?

569
00:30:07,960 --> 00:30:08,660
We talked about that.

570
00:30:08,800 --> 00:30:10,680
You know, predators, police are targets.

571
00:30:12,160 --> 00:30:15,820
We talked about the nuclear power plant being able to resolve the information.

572
00:30:16,000 --> 00:30:16,520
It's not good.

573
00:30:17,020 --> 00:30:18,320
What would I do about it?

574
00:30:18,700 --> 00:30:21,560
First and foremost, I would plead with Facebook.

575
00:30:21,780 --> 00:30:25,460
Please, for the love of God, why are you making everything public by default?

576
00:30:25,700 --> 00:30:27,140
When somebody signs up for Facebook,

577
00:30:27,140 --> 00:30:28,560
it should be private by default.

578
00:30:28,720 --> 00:30:30,220
They should have to opt in to make it public.

579
00:30:30,360 --> 00:30:33,780
I don't know why it's not, but that's, it is what it is.

580
00:30:33,920 --> 00:30:36,940
If all they have to do is flip a switch and 99% of this goes away.

581
00:30:37,380 --> 00:30:38,160
But you know what?

582
00:30:38,180 --> 00:30:39,460
It's not entirely Facebook's fault.

583
00:30:39,580 --> 00:30:41,880
You know, they're a business and people opt in to use it.

584
00:30:41,960 --> 00:30:44,380
So, people should be smart enough to make it private.

585
00:30:45,240 --> 00:30:47,360
The one thing I really do have a problem with, though,

586
00:30:47,420 --> 00:30:51,320
is the federal government and the state governments releasing all of our information.

587
00:30:51,600 --> 00:30:53,180
Like, that shouldn't be a thing.

588
00:30:53,340 --> 00:30:56,820
And when I spoke to the CIO of the Secretary of State,

589
00:30:56,820 --> 00:30:58,340
I'm pretty sure he was CIO, I don't know,

590
00:30:58,940 --> 00:30:59,940
Secretary of State of Ohio,

591
00:31:00,880 --> 00:31:04,360
he told me that the reason that these things are available

592
00:31:04,360 --> 00:31:06,180
are because of outdated laws.

593
00:31:07,440 --> 00:31:10,060
The laws are in place that the voter records have to be public.

594
00:31:10,260 --> 00:31:11,640
So, they made them public.

595
00:31:11,980 --> 00:31:14,300
And they can't just say, hey, this is a bad idea.

596
00:31:14,560 --> 00:31:16,720
We shouldn't do this because it's the law.

597
00:31:17,880 --> 00:31:19,820
And I empathize with that.

598
00:31:19,880 --> 00:31:20,640
I get where he's coming from.

599
00:31:20,700 --> 00:31:21,320
I don't blame them.

600
00:31:21,420 --> 00:31:23,000
They're just doing what they're supposed to do.

601
00:31:24,000 --> 00:31:26,540
I do think that we need to change these laws, though.

602
00:31:26,540 --> 00:31:29,900
So, we need to get more word out there that these things are available.

603
00:31:30,440 --> 00:31:34,120
Also, you know, just because I get a traffic ticket,

604
00:31:34,220 --> 00:31:39,280
or I buy a house, or I buy a car, or I license my dog,

605
00:31:39,820 --> 00:31:44,920
that doesn't mean I'm opting in to have big data be able to farm my government data.

606
00:31:45,060 --> 00:31:48,380
Like, I don't know why, I don't know if the government's doing this willingly,

607
00:31:48,880 --> 00:31:50,020
knowingly, or unknowingly,

608
00:31:50,100 --> 00:31:53,280
but they're really selling us out to all these marketing firms.

609
00:31:53,440 --> 00:31:55,440
Like, my identity should,

610
00:31:55,440 --> 00:31:56,720
I only get one of them.

611
00:31:56,860 --> 00:32:02,620
You know, unless I turn state witness and I get in the protection program,

612
00:32:03,040 --> 00:32:04,060
I only get one identity.

613
00:32:04,480 --> 00:32:07,260
So, it should be my choice on whether or not it gets put out there or not.

614
00:32:07,360 --> 00:32:11,720
And the government is stripping us of that capability by just releasing this information.

615
00:32:12,560 --> 00:32:15,020
So, I definitely think we need to change these laws.

616
00:32:15,720 --> 00:32:17,000
It's not specific to Ohio.

617
00:32:17,320 --> 00:32:20,220
I just use Ohio because that's where I live and I want to pick on them.

618
00:32:21,980 --> 00:32:23,080
So, here's the summary.

619
00:32:23,440 --> 00:32:24,900
One, you can't opt out of the internet.

620
00:32:25,440 --> 00:32:26,500
If you put it on the internet, it's out there.

621
00:32:26,520 --> 00:32:28,500
I think that's on a famous shirt somewhere.

622
00:32:29,060 --> 00:32:32,540
If you put it on the internet, it's out there forever and it is public.

623
00:32:34,520 --> 00:32:37,860
Voting, getting tickets, owning a dog, buying a house, things like that,

624
00:32:37,980 --> 00:32:39,960
it shouldn't be opting in to big data.

625
00:32:40,220 --> 00:32:41,940
And the laws definitely need to catch up.

626
00:32:42,040 --> 00:32:42,720
We need to do this.

627
00:32:42,880 --> 00:32:46,760
If the people don't say something, it's never going to change.

628
00:32:46,940 --> 00:32:49,960
And that was kind of why I chose to put this information out there and this tool out there.

629
00:32:50,540 --> 00:32:52,180
The source code is on my GitHub.

630
00:32:53,160 --> 00:32:55,420
I really hope that everyone goes and downloads it.

631
00:32:55,440 --> 00:32:56,440
Make your own modules.

632
00:32:57,060 --> 00:32:58,500
Go build a LinkedIn module.

633
00:32:58,660 --> 00:32:59,720
Go build a Google module.

634
00:33:00,480 --> 00:33:01,280
Scrape everything.

635
00:33:02,300 --> 00:33:03,420
Hack all the things.

636
00:33:04,200 --> 00:33:05,100
Make it awesome.

637
00:33:05,200 --> 00:33:05,840
Share it with me.

638
00:33:05,920 --> 00:33:08,420
I'll echo it back out and see if I can add more.

639
00:33:08,840 --> 00:33:10,780
I would really love to collaborate on this.

640
00:33:11,080 --> 00:33:12,700
I'm going to continue developing this.

641
00:33:12,920 --> 00:33:15,340
I'm going to be presenting this again in a few months at JuryCon.

642
00:33:15,520 --> 00:33:16,620
I'm going to be doing a 2.0.

643
00:33:17,380 --> 00:33:20,240
So, we're going to have even more modules in here right now.

644
00:33:20,480 --> 00:33:21,760
It's just Facebook and people.

645
00:33:22,400 --> 00:33:23,580
But I want to get LinkedIn.

646
00:33:25,440 --> 00:33:26,240
A whole bunch of fun stuff.

647
00:33:26,740 --> 00:33:27,500
That's my blog.

648
00:33:27,700 --> 00:33:30,080
I post all types of random tech stuff on there.

649
00:33:30,180 --> 00:33:31,260
I'm studying for my OSCP.

650
00:33:31,480 --> 00:33:35,220
So, every now and then, you'll see me post a bone hub VM cracks on there.

651
00:33:35,380 --> 00:33:38,020
And there's my GitHub and my Twitter.

652
00:33:39,460 --> 00:33:41,040
And I'll open the floor for questions.

653
00:33:41,140 --> 00:33:41,560
Thank you.

654
00:33:45,260 --> 00:33:45,620
Yeah.

655
00:33:50,700 --> 00:33:51,060
Sure.

656
00:33:53,540 --> 00:33:59,200
So, originally, I wanted to do it in Python or some language I could do in multi-platform.

657
00:33:59,360 --> 00:34:01,080
But I ended up opting for C Sharp.

658
00:34:01,440 --> 00:34:01,720
Sorry.

659
00:34:01,980 --> 00:34:03,100
I'll try and port it one day.

660
00:34:03,220 --> 00:34:03,580
We'll see.

661
00:34:04,520 --> 00:34:05,900
That was my next question.

662
00:34:06,080 --> 00:34:06,340
Oh, yeah.

663
00:34:06,400 --> 00:34:07,180
I'll be porting it.

664
00:34:08,020 --> 00:34:08,300
Yeah.

665
00:34:08,600 --> 00:34:09,460
I'll be trying to port it.

666
00:34:09,480 --> 00:34:10,380
I mean, you could run it in mono.

667
00:34:10,520 --> 00:34:11,080
It should work.

668
00:34:11,180 --> 00:34:11,500
I don't know.

669
00:34:11,560 --> 00:34:11,940
We'll see.

670
00:34:12,400 --> 00:34:14,540
I'll try and run it in mono and see if it works.

671
00:34:14,660 --> 00:34:15,540
I don't see why it wouldn't.

672
00:34:16,300 --> 00:34:16,580
Yes.

673
00:34:16,780 --> 00:34:18,160
What is your next step for this research?

674
00:34:18,480 --> 00:34:21,040
So, the next step for the research is I want to do this.

675
00:34:21,040 --> 00:34:25,960
So, I want to be able to go to Starbucks and sit down and resolve addresses of people

676
00:34:25,960 --> 00:34:27,820
around me based on packet sniffing.

677
00:34:29,500 --> 00:34:31,000
So, it's an idea.

678
00:34:31,280 --> 00:34:32,660
I need more modules.

679
00:34:33,380 --> 00:34:36,680
Originally, I wanted to do it with Facebook because I was hoping that I could abstract

680
00:34:36,680 --> 00:34:39,760
their profile out of the get parameters.

681
00:34:39,880 --> 00:34:40,900
But it's all TLS.

682
00:34:41,100 --> 00:34:42,040
So, I don't think that's going to happen.

683
00:34:42,940 --> 00:34:43,960
There might be other ways.

684
00:34:44,100 --> 00:34:44,440
We'll see.

685
00:34:45,960 --> 00:34:46,400
Yes.

686
00:34:46,680 --> 00:34:49,100
Based on your experience, companies like Smokio.

687
00:34:49,220 --> 00:34:49,660
Yes.

688
00:34:49,660 --> 00:34:54,540
And all these other like find a friend type pop-up sites that just come up.

689
00:34:54,680 --> 00:35:01,860
How are these websites so successful at data mining and finding out all this crap about

690
00:35:01,860 --> 00:35:02,120
something?

691
00:35:02,340 --> 00:35:02,660
Yeah.

692
00:35:02,740 --> 00:35:03,660
That's a great question.

693
00:35:03,780 --> 00:35:07,700
So, they, when I was originally doing my research on privacy and trying to opt out

694
00:35:07,700 --> 00:35:12,180
of everything, I started with Spokio and White Pages and all those and worked my way up.

695
00:35:13,360 --> 00:35:16,480
They're so successful because they're getting all their information from pretty much the

696
00:35:16,480 --> 00:35:16,820
same spot.

697
00:35:17,460 --> 00:35:21,240
They're all buying services from like Intellisys.

698
00:35:21,380 --> 00:35:22,460
I think it's Intellisys.

699
00:35:22,540 --> 00:35:23,240
I think that's their name.

700
00:35:23,900 --> 00:35:27,060
They're buying their data from big companies like that.

701
00:35:27,120 --> 00:35:30,020
And those big companies are going, you can opt out of them.

702
00:35:30,120 --> 00:35:30,780
But guess what?

703
00:35:30,840 --> 00:35:33,760
They're going to the voter database and the traffic violations.

704
00:35:33,980 --> 00:35:36,060
They're going to public things that you can't opt out of.

705
00:35:36,300 --> 00:35:40,380
So, eventually, you hit a point where there's no more opting out.

706
00:35:40,480 --> 00:35:44,460
They're taking things they're allowed to take and they're doing connections very similar

707
00:35:44,460 --> 00:35:45,720
to what I'm doing, I would imagine.

708
00:35:47,140 --> 00:35:49,660
So, yeah, unfortunately, there's no getting away from it.

709
00:35:51,180 --> 00:35:52,080
Any other questions?

710
00:35:52,380 --> 00:35:52,720
Yes?

711
00:35:52,980 --> 00:35:53,360
.

712
00:35:54,800 --> 00:35:55,240
No.

713
00:35:55,380 --> 00:36:01,520
So, I looked into getting more states, but I wanted to be, I wanted to focus in on doing

714
00:36:01,520 --> 00:36:04,120
as much damage as I could as opposed to collecting as much data.

715
00:36:04,300 --> 00:36:08,640
This can be applied to every state because the voter database, it's the same, as far

716
00:36:08,640 --> 00:36:11,720
as my understanding, it's the same format for every single state.

717
00:36:11,940 --> 00:36:13,860
So, I use the Ohio database.

718
00:36:14,140 --> 00:36:15,060
So, in the tool.

719
00:36:16,620 --> 00:36:17,820
I put this in here.

720
00:36:18,080 --> 00:36:20,180
I didn't talk about it, but it's in the tool.

721
00:36:21,080 --> 00:36:24,100
In the settings, you can go in here and set, like, your people API key.

722
00:36:24,180 --> 00:36:27,720
So, if you have, like, a real people API key, like when you pay for, you can put it

723
00:36:27,720 --> 00:36:28,000
in there.

724
00:36:29,100 --> 00:36:33,420
You just put your connection string in there for your database, what state you're doing.

725
00:36:33,540 --> 00:36:38,080
That's the, that'll be the state that we look for and then your state or your table

726
00:36:38,080 --> 00:36:39,820
name and it'll just kind of all work.

727
00:36:40,020 --> 00:36:40,380
What's that?

728
00:36:40,680 --> 00:36:41,000
.

729
00:36:43,100 --> 00:36:44,280
That's a, it's a demo key.

730
00:36:44,400 --> 00:36:45,040
It's a demo key.

731
00:36:45,060 --> 00:36:45,780
I, I register.

732
00:36:45,960 --> 00:36:49,280
So, whenever I do this demo, I go to Yandex.

733
00:36:49,300 --> 00:36:53,200
I create a fake email and then I go register a people, a free account for people.

734
00:36:53,360 --> 00:36:59,320
It takes, like, 10 seconds and you get 30, I think it's, like, 30 queries for 30 days

735
00:36:59,320 --> 00:37:00,640
or 15 days or something like that.

736
00:37:00,800 --> 00:37:02,920
So, you can, you can do it over and over and over again.

737
00:37:03,060 --> 00:37:07,300
If you write a script or a tool to create accounts for you, you just get a bunch of

738
00:37:07,300 --> 00:37:09,440
accounts, but I didn't go that far.

739
00:37:11,480 --> 00:37:12,300
Any other questions?

740
00:37:12,440 --> 00:37:12,680
Yes.

741
00:37:13,600 --> 00:37:13,960
.

742
00:37:16,260 --> 00:37:16,620
Yeah.

743
00:37:17,760 --> 00:37:19,480
So, that took some time.

744
00:37:20,000 --> 00:37:21,240
It was totally arbitrary.

745
00:37:21,560 --> 00:37:23,360
I don't want anybody to think I'm not a data scientist.

746
00:37:23,620 --> 00:37:24,300
I'm not a data analyst.

747
00:37:24,420 --> 00:37:25,340
I have no idea what I'm doing.

748
00:37:25,500 --> 00:37:31,200
I just went in there and I tweaked it until I was getting really confident results and

749
00:37:31,200 --> 00:37:32,040
it just worked.

750
00:37:32,200 --> 00:37:36,780
So, I'm sure there are much better ways to do it and if anybody has any ideas, please

751
00:37:36,780 --> 00:37:37,880
feel free to reach out to me.

752
00:37:37,940 --> 00:37:42,120
I would love to work with you and come up with something that I can say, this works

753
00:37:42,120 --> 00:37:43,600
because of proof, you know?

754
00:37:43,600 --> 00:37:43,940
And, you know, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's,

755
00:37:43,940 --> 00:37:50,320
right now, it's, I, I, I ran some, some large scale tests, you know, like a thousand,

756
00:37:50,460 --> 00:37:52,540
two thousand people, which by the way, you can do.

757
00:37:52,620 --> 00:37:54,880
You can just query over and over, over on Facebook, forever.

758
00:37:55,760 --> 00:37:59,200
So, I, I ran some large scale tests with like, everybody in my city.

759
00:37:59,980 --> 00:38:02,960
And, it was probably about fifty to sixty-percent accurate.

760
00:38:03,120 --> 00:38:08,420
If you consider eighty percent or above confidence score, or a 0.8 or above, I don't say percent

761
00:38:08,420 --> 00:38:09,120
because there's no percent.

762
00:38:09,440 --> 00:38:11,540
. Eight or above, is the confidence score.

763
00:38:11,640 --> 00:38:13,800
It's like fifty, sixty, seventy percent in there.

764
00:38:13,900 --> 00:38:13,920
Yeah.

765
00:38:13,940 --> 00:38:22,000
uh accuracy uh if you lower that to 0.7 you get much higher like uh 80 accuracy uh so yeah it's i

766
00:38:22,000 --> 00:38:26,400
mean it's definitely a viable means of finding people but it's probably not the best yes

767
00:38:31,800 --> 00:38:37,840
that's a great question um i don't know you know i'm i'm hoping that doing talks like this coming

768
00:38:37,840 --> 00:38:41,820
to the you know biggest hacker conference in the world and making that making a stink about it i'm

769
00:38:41,820 --> 00:38:46,980
hoping that that will that will bring some attention to the problem i i would love to work

770
00:38:46,980 --> 00:38:54,180
with uh the state the government i i've reached out to them i i reached out to the uh the ohio

771
00:38:54,180 --> 00:38:59,540
um it department i told them about this but like i said they kind of shrug at you so they're like

772
00:38:59,540 --> 00:39:03,340
it's the law what do you do so you have to you have to get put on the ballot you have to get

773
00:39:03,340 --> 00:39:08,820
people to vote it you know to vote to change it and that's it from another talk and uh there

774
00:39:08,820 --> 00:39:11,240
was a data scientist working with someone in

775
00:39:11,240 --> 00:39:11,800
japan

776
00:39:21,820 --> 00:39:23,300
oh yeah nice

777
00:39:26,080 --> 00:39:34,040
you know it's funny you mentioned that i actually did reach out to some uh local news outlets in

778
00:39:34,040 --> 00:39:39,520
ohio and i i a lot of news acres they don't use their real name for obvious reasons they'll use

779
00:39:39,520 --> 00:39:41,720
like aliases so i sent

780
00:39:41,820 --> 00:39:47,000
a couple anchors their their target profiles and hope that that would uh you know get them to

781
00:39:47,000 --> 00:39:50,620
respond to me but it didn't work so i i'll definitely do that though i i'm going to

782
00:39:50,620 --> 00:39:53,680
continue pushing on this this is definitely something i believe in i believed in it for a

783
00:39:53,680 --> 00:39:59,380
while um it's a good cause it just sucks that you know the way to get the word out there is that you

784
00:39:59,380 --> 00:40:05,240
have to kind of you know you have to drop drop information on people but pissing people off is

785
00:40:05,240 --> 00:40:09,360
the only way you're going to get anything changed otherwise um you know you're going to get people

786
00:40:09,360 --> 00:40:14,740
that say who cares you know what's somebody going to do with my my facebook profile you know who

787
00:40:14,740 --> 00:40:20,100
cares well you know if you work for a critical infrastructure then they can use it to fish you

788
00:40:20,100 --> 00:40:24,500
you know target efficient campaigns they know you like the browns which is really rare but you know

789
00:40:24,500 --> 00:40:29,680
they they know you like you know they know you like x y or z you know so they can they can make

790
00:40:29,680 --> 00:40:34,180
very target efficient campaigns they saw you posted you know that you went to starbucks someplace and

791
00:40:34,180 --> 00:40:38,360
now they're going to go and try and rip your company's rfid card off of you because they know

792
00:40:38,360 --> 00:40:44,040
where you go or uh it's the the opportunities are limitless yes

793
00:40:52,920 --> 00:40:58,540
i'm not sure i'm not sure if they are or not i hope they are uh but at the same time you run i i

794
00:40:58,540 --> 00:41:04,560
also empathize with facebook uh they they have this issue where um you know they nothing should

795
00:41:04,560 --> 00:41:08,280
be censored you know they want everything to be free and open and i believe in that

796
00:41:08,280 --> 00:41:13,660
um but at the same time you don't want people posting videos of people getting their heads cut

797
00:41:13,660 --> 00:41:17,940
off so like there's a there's a fine line you have to draw and there's a lot of work they have to put

798
00:41:17,940 --> 00:41:23,460
into um making the place safe for everyone so i don't know if they're doing that research i hope

799
00:41:23,460 --> 00:41:30,520
they do we'll see all right thank you so much i appreciate everyone's time thank you for coming

800
00:41:30,520 --> 00:41:33,000
feel free to reach out to me thank you