from everyone if you're here for I hope you're here for building Google for
criminal enterprises if not feel free to go if you don't know what that is you've
never used internet my name's Anthony Russell and you can reach me at dotnet
Russell it's a Twitter handle there's my Twitter Twitter profile my blog I
usually don't like to do in-depth speaking or in-depth about me profiles
because no one cares on things we're gonna cover today how and why this
project was started what I how I define public data and where you can find it
how we can scrape some public data and how we can scrape some social media data
and then how to link those together who cares about this and why and what would
I do to fix it and I also have a tool that I'm releasing today that I put on
github this morning so you'll be able to download it so here's the disclaimer
we're gonna be looking at some sensitive information today I would
have
appreciated if you did not harass the people that are in my slides I'm using
real information these are straight from the tool they don't deserve to be
harassed and I don't condone I don't condone doing illegal things with this
information my material or my research that said everything that's in here is
public information it's been put out by these people it's been put out either
by them or by the government on their behalf
and if I were to redact this information from my slides I feel like it wouldn't
have the impact that I intended originally when I started this project I
wrestled with this for quite some time about releasing this tool and this
information because I don't want somebody to get hurt based on it but if
we want things to change we really want things to change then we need to we need
to put this out there we need to show people what can really be done and on
that note like this is just the beginning this is just scratching the
surface this is stuff that I put together in my free time you know if
you're a nation-state or somebody that really wants to do harm you could really
do a lot with this.
also,
I talk to an attorney, so don't sue me, bro.
All right, so why this project?
So about six or seven months ago, I started looking into being able to have a public profile.
I like to do public speaking at different conferences.
I want to be able to have a public profile for conferences and for a living resume for work.
I'm sure a lot of you professionals like to have your resume online, so other companies might be able to find it.
But that's a challenge because, you know, I don't want my data raided.
So, you know, how do you keep a public profile without putting too much out there?
So as we spoke about before I got started, I'm an OIF vet.
I like to take challenges head on, so I wasn't about to, you know, just let this go.
So some of the things I started to do to try and make myself private on the web,
was I opted out of all the things, like everything I could find.
I looked for an opt-out page, all the big data farms, like everything, Intellisys, all that stuff.
I actually cut those slides out of here because I could have gone on for like three or four slides on things I've opted out of.
If you go on the GitHub, it has all the links in there.
In the slide deck, you can just click them and opt out yourself.
I scrub my social media, but unfortunately, even after you scrub it, they still hold on to that information.
You might not be visible to your friends.
You might not be visible to my tool, but it's still out there.
So what I decided to do was I decided to muddy the water a little bit.
I put a fake name.
I said I was born in 1901, said I was a girl.
You know, you just change everything, and then eventually that muddies the water, and they don't know what's real.
I scrubbed all my old email accounts against Have I Been Pwned?
Have you guys seen that site?
I'm sure a lot of you have.
I put that in there to see if any of my old emails were released at all.
I got rid of old ones.
I registered for the Do Not Call list.
I went through my phone and uninstalled every app that required any weird, wonky permissions.
So that's pretty sanitized at this point.
By the way, if you use the Facebook or Twitter app or the Facebook Messenger, that's like giving them access to your whole phone.
And then I also researched cleanup services.
There's a lot of those on the web, and they're all garbage.
Don't use them.
So I opted out of all the things, and unfortunately, it didn't work.
Six months later, I'm still getting dick enhancement pills, so it doesn't work.
Don't waste your time.
Do the pills still work?
Yeah, both.
Yes, the pills do not work.
Stay away from those.
So I figured maybe I needed a different approach, and then I got this idea.
I said, you know what?
Maybe if I build a tool that does what they do but abuses the data instead of selling it for profit, because that's what a lot of them do,
then maybe we can do it.
Maybe we can fix this problem.
So that's when I started my search for public data.
So public data, as I define it, is data that can be made public either by the local or state or federal governments,
data that can be collected from social media such as Twitter, LinkedIn, and Facebook,
and data that can be collected from APIs like the People API.
Is anybody familiar with the People API?
Sure.
If you're in this room, some of you are probably familiar with it.
It's a really nice tool.
Actually, they recently...
They recently changed their API.
You used to be able to use sample underscore key to get everything.
And in the last week, they updated their API to where you have to actually do a captcha and register a key or to get a new key.
And it's IP-based.
But unfortunately for them, you can just create a fake email account through like Yandex and register and get 30 free trials,
and you can just do that all day.
So it sucks.
They want to offer a free trial, but it doesn't really work.
So government data, as I define it, here's some of the sources that I looked at.
I looked at the voter database.
There's quite a bit in here.
Full name, date of birth, current address, party affiliation.
There's actually 99, about 99 columns.
I put 99 in there.
I think that's what I counted.
There could be more or less by a few.
Property records.
So if you buy a house or, yeah, basically if you buy a house, at least in Ohio, all that information is public.
I'm sure it's the same in most states.
Traffic violations.
If you get a ticket, your information is out there.
Full name, date of birth, current address.
You can just go to the county website and research traffic violations.
Register your pet.
I don't know.
I have a dog and I don't feel like just because I have a dog, my information should be out there.
But apparently it is.
And car registration.
I put a question mark next to this.
I'm hoping somebody that watches this can help me.
I bought a car earlier this year.
And, you know, I'm super conscious about what information I let out there and what I sign up for.
I didn't sign up for anything and I started getting a ton of stuff with my exact car make and model in the mail.
So there must be some type of, yeah, oh, is that what it is?
Okay.
So, yeah, there's some public source out there that people are able to scrape and then offer you, you know, shitty fake warranties.
I would love to incorporate something like that in the future, but I couldn't figure that one out, so I left it out.
These are the ones I didn't use in my tool.
I didn't use the property records, traffic violations, or pet registration mainly because, one, I had all that information that they offered other than the specifics of the traffic violation in the voter database already.
And two, because all of these are very specific to the county, so I would have to write a tool that would scrape every county site individually and I didn't want the state, you know, ishing their pants that I was scraping every county site.
So I ended up going with the Ohio Voter Registration Tool.
So I ended up going with the Ohio Voter Registration Database.
So I spoke with the Secretary of State, CIO, and he told me that these are, that it's a common format across all states.
So theoretically, if you had another state, New York, you know, Nevada, whatever, and you were able to download their database, it would work in my tool.
So I just used Ohio because it made it super easy and they let you download six and a half million records.
In fact, I downloaded the six and a half million a few months ago.
They update this every week, so this is constantly updated with new people that register and stuff, so that's kind of scary.
But yeah, I'll have the links at the, I'll have the links in a blog post afterwards if you guys want to get the links for that.
It's also in the tool.
Here's an example of some of the data that's in the voter database.
So you get voter ID, county number, county ID, first, last, middle, date of birth, registration date, voter status, all types of stuff.
There's a lot.
There's a lot of fun things you can do with just the database.
You can search for young people near me and then filter out young women and then be a predator.
Or you can search for elderly people for me and, you know, go around and fish their, you know, Social Security checks out of their mailbox.
I know that's been a problem for a while.
So just with the voter database, you can do that kind of stuff.
I don't condone that, but, you know, that's what they're putting out there.
So now that we have our seed data, we can start getting the personal data.
Some of the sources of personal data that I looked at was Facebook, which offers a slew of things, interests, current city-state, original city-state, relationships, degree, and schools attended, and jobs.
Twitter, I tried to find a way to correlate to this.
I really did, but it's like people put, I put random shit on there.
I don't even use my real name half the time.
So, like, current thoughts, I don't know.
LinkedIn, that's a wealth of information.
I'm actually going to write a plug-in for that.
I just didn't have time to do it for DEF CON.
I'll have it done for Derby CON.
The People API, it's everything.
If you've seen the People API, you know that.
If not, it has, like, phone numbers.
I'll demonstrate it here in a minute.
It has phone numbers and relationships and every address you've lived at, every name, every alias you've gone by.
And then Instagram.
You know, I didn't incorporate Instagram, but in some of my early research, I actually did it in a blog post.
I was able to extract some detailed information about a target just from Instagram based on, like, where they're from.
Where they like to go shop and where they like to eat and some of the social activities they're involved in, like jazz band and soccer and where they played at.
Just based on Instagram.
So, that's also a great target.
So, now we're going to look into scraping Facebook.
A couple things to know about scraping Facebook is, one, it is a violation of their terms of service.
So, if you get caught doing it, they will ban you.
They didn't ban me yet, but I'm using a fake profile.
So, good luck.
And then, also, their data comes back.
When you try and scrape it, they do some things to try and...
I'm sure it wasn't to try and mitigate people scraping.
Maybe it was.
But they do some things that make it a little more difficult to scrape.
Does anybody know what Ajax is?
I don't know if we have any developers, any engineers in the room.
So, Ajax will...
It kind of speeds up the way the page loads.
It's like a trick to the eye.
So, the page will load and it will be a container.
And then, as that container loads, it will go out and make another request for the actual data.
So, if you're trying to scrape...
A lot of tools will just get you that container and you won't get the actual data.
So, it makes it a little more challenging, but I found ways around it.
It's not too hard.
Facebook elements can be scraped by focusing on automation strings.
Does anybody know what an automation string is?
So, Facebook, like any other big company, they want to be able to test their software.
So, they put these little ID tags on every element.
And then, they're able to write other programs that look through the page
for those IDs.
And then, they can put in fake data or put in real data.
And they can check values.
And they leave that in their production environment.
So, we're able to use that to scrape with.
We can say, go get me all of the info fields.
And you can get their work, you know, where they work and their education and all that stuff.
And that's the technique I'm going to show here in a second.
Also, I use multi-pass scraping.
It makes it a little bit easier.
So, I'll go through it multiple times.
So, one thing to note real quick about Facebook.
Facebook is this query right here.
Search slash people.
And then, the little Q is the query.
So, unauthenticated, I've only noticed that you'll get prompted with a captcha once.
It may be more than that.
I've run this thousands and thousands of times.
If you're authenticated, though, you can run this endlessly without a captcha ever.
So, if you create a fake Facebook account, you can just run this query over and over and over again.
And what's fun about it is,
I can search for John Smith in Ohio.
And it'll go get me everybody in Ohio that their name is John Smith.
It works really well.
So, here's an example of that.
This is what it'll return.
And what the tool does and what we want to do is we want to get the links out of here.
Because, obviously, the names are hyperlinks.
So, we want to grab those.
So, how do we do that?
Well, these are the tools that I tried to do that with.
I tried using curl and wget and links.
Because I really didn't want to write this in anything that I couldn't run in the terminal.
But, unfortunately, that didn't happen.
I tried the WPF web browser.
It wasn't very...
It was limited on function calls.
So, I ended up going with the WinForms browser.
Fun thing about WinForms browser.
It has a memory leak in the...
You know when you have your browser open and you have the back button?
Well, it keeps a log of everything that you've done.
Well, when you navigate like 10,000 times, that back button doesn't empty out ever.
Like the history cache doesn't ever empty out.
And it took me forever to figure this out.
But, yeah, there's a memory leak in there.
So, what I had to do was I wrote a separate application.
Then all it did was take a URL as a command parameter.
And then it dumped the source out.
And then in my application, I just spin up one instance of it.
Get the source and then close it.
And then that kind of solved the memory leak issue.
But they're never going to fix that.
So, that was my workaround.
Here's an example.
Does anybody know what a regex is?
Regexes are kind of like magic.
You really shouldn't use them for web scraping.
But, you know, why not?
It's a hacker conference.
So, this is a really basic example of the regex that I use over and over and over again.
I am not a regex pro.
I'm really not a regex pro.
Not at all.
But this is the example.
So, there's three parts to it.
I use a positive look behind, which I'll show you what each of these mean here in a second.
I use a positive look behind.
I match zero to unlimited with, and I make it lazy so it grabs just the minimum amount.
And then I use a positive look ahead.
And this is what it actually looks like.
So, this is the positive look behind.
And you see that pink little dot right there?
That's saying that, okay, this is where we're going to start.
And then when we add in the period asterisk, it grabs everything to the end of the line.
And then I add a question mark.
I make it lazy so it grabs as few as possible.
And then I add the positive look ahead, which you can't see it, but it's marking the end there by the less than symbol and the forward slash.
So, ultimately what that does, that regex will do, is it will go through, and everything that matches that regex, it will grab me the text for it.
So, that's how I use to get actually all the information.
Here's an example of how I grab the URLs off of the search.
The query page.
So, I use the, I'm not going to go too deep into this because it's kind of crazy.
But right here, you can see the data test ID.
This is something they would use to be testing with.
I'm guessing this is their automation ID.
I don't know.
Maybe not.
But it was unique, so I used that.
And it grabs the center part right here.
You can see there's the data test ID SERP result.
This is actually, this is the real code.
And then, you know, I look for div.
A-H-R-E-F.
So, div.
A-H-R-E-F.
And then, that would be where the pink line is right there.
So, this is the target information.
This is what I want to grab off of a profile.
And, I mean, if I'm doing this with an unknown amount of profiles for unknown people, you've got to use regex.
So, I use something I like to refer to as multi-pass regex scraping.
So, I'll grab all the source.
And then, I'll get chunks.
Chunks out of what I want.
And then, I'll run regexes over those chunks.
So, I use three passes to get the profile information.
This is like where the person worked and where they studied and things like that.
So, real quick, here's the first pass.
The first pass will get everything in blue.
Now, the blue is, this is each of those blocks.
So, you can see the first one says it's their high school.
And the second one says it's the electronic classroom tomorrow.
And the third one is it's probably their location, where they're from.
And that's ultimately what I want to get.
So, right now, I have the blue chunks.
So, then we run another regex over it.
And this regex cuts it down even more.
And, as you can see, we still have our data in here that we're trying to abstract.
But we have a lot less.
So, this is the second chunk that we have now.
And then, finally, in the last chunk, it's really easy.
We just look for the, let's see, we look for the greater than symbol right there.
And there's only one greater than symbol in the chunk.
So, it's easy to grab the data.
And then, I add that to a list in the application.
And we can use that for analysis.
So, now that we have it, let's start analyzing it and figuring out if we have our target.
So, I'm going to use a different example.
This is actually a full example.
And this is real data.
So, please don't harass this person.
So, I'm going to use a result from the voter database.
And then, I'm going to look at a series of Facebook profiles.
That could possibly be that person.
And we're going to try and match them up to find the actual person.
So, this is our target.
Her name is Samantha Adkins.
She's 18.
She's from Lakewood, Ohio.
I got this just by querying for 18-year-olds in Lakewood.
And I found one on a street.
There were a number of results.
But you can do this in any city.
And you should be able to do this with any state.
And then, I ran that query, our Facebook query, for Samantha Adkins.
The plus symbols are just spaces.
A lot of devs know that.
But if you're not a dev, that's all it is.
It's just a space.
I think you can use %20 in this, too.
I think that'll work.
It should.
But these are the results we got.
Each of these is a profile that we scraped off the page using those regexes.
And now, we want to dig into each of those profiles.
And we want to see if that's our person.
So, we've got to scrape the details off.
So, we're assuming we're scraping the details off.
This is actually kind of super arbitrary.
I don't know if you...
Did anybody read the 2600 article I wrote?
Yeah.
Okay.
So, this is super arbitrary.
All right.
I messed with the scores until I got back really good results.
So, if somebody way smarter than me, which is probably everybody, can come up with something better,
please let me know.
I would love to actually have a really good algorithm for this.
But I look at the profile.
And I say, okay, if the first name exists, they get .15.
If the last name exists, they get .15.
And then one of these three cases down here will be true.
Either the city and state will be found and they'll get .7.
Or just the state is found and they get .1.
Or just the city is found and they get .4.
And then that builds a confidence score.
And we're able to identify targets with it.
So, as you can see, all those profiles, we have .41, .41, .41, .42, .43, and then 1.02.
So, that is a really strong match.
And if we look at it, you can see that...
Samantha Atkins from Lakewood, Ohio.
And this is very likely our target.
So, based on this, what do we know about our target now?
So, we have her full legal name.
We have her home address.
We have her date of birth.
We have photos of her.
We know her interests.
We have her relationship status.
We know who her partner is.
And a slew of other information.
But we can actually do more than that.
We can do a lot more.
That was a simple example.
That was something that...
That was originally what I wanted to demo as my project.
But then I started thinking, you know, like a bad guy.
And I said, well, you know, what if I really wanted to do damage with this?
It's one thing to be able to walk down the road and say, oh, yeah, you know, so-and-so lives there.
But, you know, what if we started with Facebook and used their search tools and then worked backwards and try and resolve, you know, people that way?
So, you know, what if we search for people that work for things like the USPS?
Or the Cleveland Police Department?
Or the Cleveland Fire Department?
Or the Perinuclear Power Plant?
Or the Ohio National Guard?
Or one of other...
One of another million, you know, possible, you know, places that people would probably not want you to know they live.
So I'm going to demo a tool that I've been working on.
It's definitely not a final tool yet.
I'm going to keep working on it.
But...
Let's see here.
You probably won't be able to see some of the text.
It's okay.
That's not important.
The first thing I'm going to demo is the database searching.
So with this, this is just...
I mean, it's just an interface to the database.
I'm going to search for people that were born after 1998.
We're going to choose a street here.
All right.
I'm going to hit search.
And hopefully it works.
I have videos.
If it doesn't work, don't worry.
The Wi-Fi is kind of wonky.
So what it's doing is it's searching a database that I have recreated in Azure.
I downloaded it from the Ohio Secretary of State website.
And as you see here, we get a number of results.
And these are all people that are right around 18 that live on...
That live on Clifton in Lakewood, Ohio.
So I pulled...
I made a couple notes here because I didn't want to accidentally show, like, minors and things.
So I'm going to use Julia Alvarez here.
Let's try her.
So this is the application opening up, spawning a browser.
And now it's searching Facebook.
There must be two profiles that came back.
And as you can see, Julia Alvarez came back with a score of 1.04.
And if we visit the page, that's Julia Alvarez from Lakewood, Ohio, Lakewood High School.
So we have all this information.
And in a matter of seconds, we've managed to find an 18-year-old that lives on a street.
It could be your street.
And we know their personal information.
We have a Facebook link to it.
So that was originally what the project was about.
But then I would...
You know, that was kind of easy to do.
So I wanted to go a little bit further.
So this is...
You probably...
If anybody uses Facebook, you'll recognize this is the Find Friends page.
I just embedded it right in my application.
And you'll notice over here on the right, they have the Search for Friends.
The Search for Friends search criteria.
So I'm going to search for something like perinuclear power.
If you don't know, perinuclear power plant is a nuclear power plant in the state of Ohio.
And people register it as their workplace.
That's critical infrastructure.
Nuclear power plants have been in the news recently as targets of opportunity for foreign agents.
For phishing campaigns, trying to get credentials, identity theft, a number of other things.
So I've got my results here.
I'm going to click this button up here at the top that says click here to import into Alohomora.
And we get this result back.
So these are all the people over here on the left.
And we can just...
Let's choose this guy.
And let's scrape his Facebook information.
So that pulls down his Facebook information.
Jason Weeks from Ashtabula, Ohio.
It's a little broken.
So a quick story about the jobs thing up here.
I was trying to actually break down the different details confidently, like what they were.
And I had the bright idea to use the ID of the image.
Because if you look at the Facebook profile, like we can open it up here and I can take a look.
So if we look at Jason Weeks' profile here, you can see the little suitcase.
I said, oh, well, those images are probably unique.
I wonder if I could just use the ID of those images and know that what's in that column is a job.
But it keeps breaking.
I think they're changing the IDs randomly every so often.
So I have to figure out a way around that.
But the good news is we still have all the details and we can still use it.
So we just scraped his information.
We see that he works at a perinuclear power plant.
He was in the Navy.
We see what school he went to.
We also see his girlfriend or wife's name, his spouse's name.
We can search the voter database and see if there's any information there on them.
And that should bring back a result.
So as you can see, we get his home address now and his age.
And then I also built in a module for the people API.
And I tested it this morning, so I hope it works.
Okay.
We get a bunch of results back for the different people.
Now, we would have to dig through this.
It depends on the person that you're pulling back, whether or not it's him.
I don't think that's him.
It depends on the person you're pulling back on what information you get.
This one has been kind of wonky.
I don't know if people's messing with me or not because I've searched this guy like a million times at this point.
So I don't know if they're just trying to like send me back a ton of results.
We can use this lady here.
I think she comes back pretty well.
This is another one.
So obviously that's not her.
That's probably her son.
But she also works at PeriNuclear Power Plant.
Yeah, that's her last name.
So let's go ahead and search the voter database.
See if that brings anything back.
We can also search the people API and see if anything returns from that.
But I guess the point that I'm trying to make with this is that so that's probably her right there.
Yeah.
So as you can see, she's got a picture of her son in there.
We can definitely extract a ton of information using these methods.
Now, like I said, this is just a demo.
This isn't something that I meant to put in here as a tool that I want people to go use.
I'm just trying to highlight a point that with these methods, we can build detailed target profiles for phishing campaigns or for identity theft for a number of things that are nefarious.
Okay.
So Mr. Shelton here.
See if we can get his home address.
I don't think that's him.
But we would be able to find him.
He's in here.
That's not him.
But the point is we can do it.
So let's head back over to the slides really quick.
All right.
So.
Who cares?
Well, I would hope that these people that I presented today care for one.
I know that when I was in the military, especially when I was stateside, I was a police officer.
I did not want anybody knowing where I lived for obvious reasons.
Right.
You know, if you give somebody a DUI, you don't want them to be able to figure out where you live and come firebomb your house.
That's probably not a good thing.
Or have your phone numbers and harass you or one of a million scenarios.
That's just the local stuff.
What about the critical infrastructure, the nuclear power plant?
We saw the details we can get from that.
I don't want foreign agents being able to fish critical infrastructure.
Like, that shouldn't be a thing.
But it is.
What else?
I mean, plotting troop movements.
So we can do that with the National Guard and the Army.
We can figure out where our troops are, figure out where their families live.
Does anybody know what FRG is?
Anybody?
Raise your hand if you know what FRG is.
No one?
All right.
I was trying to weed out the feds.
All right.
FRG is Family Readiness Group.
I wanted to save this story.
So FRG is Family Readiness Group.
When I was in the military, they're like the Army spouses that stay back.
Or the military spouses that stay back, I should say.
And they form together and they provide information to each other and support.
They're a really great group.
But when I went overseas, unfortunately, there was a miscommunication.
The FRG really shouldn't be contacted.
We were contacting family members of soldiers and telling them about firefights and things.
Well, we had a firefight and we were on blackout.
We weren't able to communicate outside of the base.
And the FRG went and called my family.
They called my mom and told her there was a bloodbath and all these types of stuff.
And my mom was freaking out and I had no idea.
And I was on blackout.
We were on blackout.
We couldn't call anybody for weeks.
So, yeah, it's not a good thing to be able to contact your family.
Contact the family of soldiers to be able to get information.
I want that information secured.
So, who cares about this data?
We talked about that.
You know, predators, police are targets.
We talked about the nuclear power plant being able to resolve the information.
It's not good.
What would I do about it?
First and foremost, I would plead with Facebook.
Please, for the love of God, why are you making everything public by default?
When somebody signs up for Facebook,
it should be private by default.
They should have to opt in to make it public.
I don't know why it's not, but that's, it is what it is.
If all they have to do is flip a switch and 99% of this goes away.
But you know what?
It's not entirely Facebook's fault.
You know, they're a business and people opt in to use it.
So, people should be smart enough to make it private.
The one thing I really do have a problem with, though,
is the federal government and the state governments releasing all of our information.
Like, that shouldn't be a thing.
And when I spoke to the CIO of the Secretary of State,
I'm pretty sure he was CIO, I don't know,
Secretary of State of Ohio,
he told me that the reason that these things are available
are because of outdated laws.
The laws are in place that the voter records have to be public.
So, they made them public.
And they can't just say, hey, this is a bad idea.
We shouldn't do this because it's the law.
And I empathize with that.
I get where he's coming from.
I don't blame them.
They're just doing what they're supposed to do.
I do think that we need to change these laws, though.
So, we need to get more word out there that these things are available.
Also, you know, just because I get a traffic ticket,
or I buy a house, or I buy a car, or I license my dog,
that doesn't mean I'm opting in to have big data be able to farm my government data.
Like, I don't know why, I don't know if the government's doing this willingly,
knowingly, or unknowingly,
but they're really selling us out to all these marketing firms.
Like, my identity should,
I only get one of them.
You know, unless I turn state witness and I get in the protection program,
I only get one identity.
So, it should be my choice on whether or not it gets put out there or not.
And the government is stripping us of that capability by just releasing this information.
So, I definitely think we need to change these laws.
It's not specific to Ohio.
I just use Ohio because that's where I live and I want to pick on them.
So, here's the summary.
One, you can't opt out of the internet.
If you put it on the internet, it's out there.
I think that's on a famous shirt somewhere.
If you put it on the internet, it's out there forever and it is public.
Voting, getting tickets, owning a dog, buying a house, things like that,
it shouldn't be opting in to big data.
And the laws definitely need to catch up.
We need to do this.
If the people don't say something, it's never going to change.
And that was kind of why I chose to put this information out there and this tool out there.
The source code is on my GitHub.
I really hope that everyone goes and downloads it.
Make your own modules.
Go build a LinkedIn module.
Go build a Google module.
Scrape everything.
Hack all the things.
Make it awesome.
Share it with me.
I'll echo it back out and see if I can add more.
I would really love to collaborate on this.
I'm going to continue developing this.
I'm going to be presenting this again in a few months at JuryCon.
I'm going to be doing a 2.0.
So, we're going to have even more modules in here right now.
It's just Facebook and people.
But I want to get LinkedIn.
A whole bunch of fun stuff.
That's my blog.
I post all types of random tech stuff on there.
I'm studying for my OSCP.
So, every now and then, you'll see me post a bone hub VM cracks on there.
And there's my GitHub and my Twitter.
And I'll open the floor for questions.
Thank you.
Yeah.
Sure.
So, originally, I wanted to do it in Python or some language I could do in multi-platform.
But I ended up opting for C Sharp.
Sorry.
I'll try and port it one day.
We'll see.
That was my next question.
Oh, yeah.
I'll be porting it.
Yeah.
I'll be trying to port it.
I mean, you could run it in mono.
It should work.
I don't know.
We'll see.
I'll try and run it in mono and see if it works.
I don't see why it wouldn't.
Yes.
What is your next step for this research?
So, the next step for the research is I want to do this.
So, I want to be able to go to Starbucks and sit down and resolve addresses of people
around me based on packet sniffing.
So, it's an idea.
I need more modules.
Originally, I wanted to do it with Facebook because I was hoping that I could abstract
their profile out of the get parameters.
But it's all TLS.
So, I don't think that's going to happen.
There might be other ways.
We'll see.
Yes.
Based on your experience, companies like Smokio.
Yes.
And all these other like find a friend type pop-up sites that just come up.
How are these websites so successful at data mining and finding out all this crap about
something?
Yeah.
That's a great question.
So, they, when I was originally doing my research on privacy and trying to opt out
of everything, I started with Spokio and White Pages and all those and worked my way up.
They're so successful because they're getting all their information from pretty much the
same spot.
They're all buying services from like Intellisys.
I think it's Intellisys.
I think that's their name.
They're buying their data from big companies like that.
And those big companies are going, you can opt out of them.
But guess what?
They're going to the voter database and the traffic violations.
They're going to public things that you can't opt out of.
So, eventually, you hit a point where there's no more opting out.
They're taking things they're allowed to take and they're doing connections very similar
to what I'm doing, I would imagine.
So, yeah, unfortunately, there's no getting away from it.
Any other questions?
Yes?
.
No.
So, I looked into getting more states, but I wanted to be, I wanted to focus in on doing
as much damage as I could as opposed to collecting as much data.
This can be applied to every state because the voter database, it's the same, as far
as my understanding, it's the same format for every single state.
So, I use the Ohio database.
So, in the tool.
I put this in here.
I didn't talk about it, but it's in the tool.
In the settings, you can go in here and set, like, your people API key.
So, if you have, like, a real people API key, like when you pay for, you can put it
in there.
You just put your connection string in there for your database, what state you're doing.
That's the, that'll be the state that we look for and then your state or your table
name and it'll just kind of all work.
What's that?
.
That's a, it's a demo key.
It's a demo key.
I, I register.
So, whenever I do this demo, I go to Yandex.
I create a fake email and then I go register a people, a free account for people.
It takes, like, 10 seconds and you get 30, I think it's, like, 30 queries for 30 days
or 15 days or something like that.
So, you can, you can do it over and over and over again.
If you write a script or a tool to create accounts for you, you just get a bunch of
accounts, but I didn't go that far.
Any other questions?
Yes.
.
Yeah.
So, that took some time.
It was totally arbitrary.
I don't want anybody to think I'm not a data scientist.
I'm not a data analyst.
I have no idea what I'm doing.
I just went in there and I tweaked it until I was getting really confident results and
it just worked.
So, I'm sure there are much better ways to do it and if anybody has any ideas, please
feel free to reach out to me.
I would love to work with you and come up with something that I can say, this works
because of proof, you know?
And, you know, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's, it's,
right now, it's, I, I, I ran some, some large scale tests, you know, like a thousand,
two thousand people, which by the way, you can do.
You can just query over and over, over on Facebook, forever.
So, I, I ran some large scale tests with like, everybody in my city.
And, it was probably about fifty to sixty-percent accurate.
If you consider eighty percent or above confidence score, or a 0.8 or above, I don't say percent
because there's no percent.
. Eight or above, is the confidence score.
It's like fifty, sixty, seventy percent in there.
Yeah.
uh accuracy uh if you lower that to 0.7 you get much higher like uh 80 accuracy uh so yeah it's i
mean it's definitely a viable means of finding people but it's probably not the best yes
that's a great question um i don't know you know i'm i'm hoping that doing talks like this coming
to the you know biggest hacker conference in the world and making that making a stink about it i'm
hoping that that will that will bring some attention to the problem i i would love to work
with uh the state the government i i've reached out to them i i reached out to the uh the ohio
um it department i told them about this but like i said they kind of shrug at you so they're like
it's the law what do you do so you have to you have to get put on the ballot you have to get
people to vote it you know to vote to change it and that's it from another talk and uh there
was a data scientist working with someone in
japan
oh yeah nice
you know it's funny you mentioned that i actually did reach out to some uh local news outlets in
ohio and i i a lot of news acres they don't use their real name for obvious reasons they'll use
like aliases so i sent
a couple anchors their their target profiles and hope that that would uh you know get them to
respond to me but it didn't work so i i'll definitely do that though i i'm going to
continue pushing on this this is definitely something i believe in i believed in it for a
while um it's a good cause it just sucks that you know the way to get the word out there is that you
have to kind of you know you have to drop drop information on people but pissing people off is
the only way you're going to get anything changed otherwise um you know you're going to get people
that say who cares you know what's somebody going to do with my my facebook profile you know who
cares well you know if you work for a critical infrastructure then they can use it to fish you
you know target efficient campaigns they know you like the browns which is really rare but you know
they they know you like you know they know you like x y or z you know so they can they can make
very target efficient campaigns they saw you posted you know that you went to starbucks someplace and
now they're going to go and try and rip your company's rfid card off of you because they know
where you go or uh it's the the opportunities are limitless yes
i'm not sure i'm not sure if they are or not i hope they are uh but at the same time you run i i
also empathize with facebook uh they they have this issue where um you know they nothing should
be censored you know they want everything to be free and open and i believe in that
um but at the same time you don't want people posting videos of people getting their heads cut
off so like there's a there's a fine line you have to draw and there's a lot of work they have to put
into um making the place safe for everyone so i don't know if they're doing that research i hope
they do we'll see all right thank you so much i appreciate everyone's time thank you for coming
feel free to reach out to me thank you