1 00:00:00,000 --> 00:00:06,980 Hi, thanks for coming. My name is Zimbar. Last week was my last week at PerimeterX, 2 00:00:07,040 --> 00:00:11,680 so I'm giving this with permission, but as you can see it says former principal researcher. 3 00:00:13,060 --> 00:00:18,360 This is with permission, and I'm going to be telling you a long story that starts roughly 4 00:00:19,800 --> 00:00:26,140 almost two years ago, maybe a year and a half ago, and it actually includes new stuff as 5 00:00:26,140 --> 00:00:31,640 well, right? I'm going to be going through it really fast because this can be told over 6 00:00:31,640 --> 00:00:36,340 a whole hour, and we only have half an hour, so if you have any questions, then just come 7 00:00:36,340 --> 00:00:41,360 and ask me later. There are some photos here that are taken from 8 00:00:41,360 --> 00:00:46,080 Tinder, some of them from other websites, so they include a little bit of nudity. It's 9 00:00:46,080 --> 00:00:50,900 all censored. It's still R-rated, but it's censored. If you're offended by that, then 10 00:00:50,900 --> 00:00:55,200 overt your eyes when it comes up. First thing about Tinder, it's an application 11 00:00:55,200 --> 00:00:56,120 that's being used by all the people, and it's being used by all the people. 12 00:00:56,140 --> 00:01:00,560 almost 50 million people, according to recent estimates, is building your profiles. And there's 13 00:01:00,560 --> 00:01:05,380 a lot of material on the internet on how to build a good profile that will guarantee you 14 00:01:05,380 --> 00:01:09,260 a better match. Is anyone here not familiar with Tinder at all? Never used it? 15 00:01:10,920 --> 00:01:13,960 Okay, so basically you see photos of women. 16 00:01:16,040 --> 00:01:22,040 Guys, someone had to say it for the benefit of those who are ashamed. So you basically see 17 00:01:22,040 --> 00:01:27,600 photos of the sex that you're interested in, male or female, and if you like, you swipe right, 18 00:01:27,640 --> 00:01:32,960 and if you don't like, you swipe left. Okay, that's it, right? So it's all about first impression. 19 00:01:33,320 --> 00:01:37,280 So there are a lot of articles that tell you how to build a perfect profile, and you can even 20 00:01:37,280 --> 00:01:44,020 read stuff by the Tinder CEO that tells you what the best way is, okay? So here's me building the 21 00:01:44,020 --> 00:01:48,240 perfect profile. You need to have a professional profile photo. I have this one, and this was 22 00:01:48,240 --> 00:01:51,920 taken when I was working at Perimeter X. Perfect match. Good. 23 00:01:52,040 --> 00:01:56,620 You need a photo with an animal to show that you're compassionate. There you go. 24 00:01:57,800 --> 00:02:04,180 Anybody knows what this is? This is Slow Laurie. Yes, it is. This was taken in Myanmar, Burma. 25 00:02:05,660 --> 00:02:11,420 Check. You need something with sports or a hobby to show you have a life, right? There you go. 26 00:02:11,540 --> 00:02:15,340 And this one actually, this has an animal as well, so I've got them covered, right? 27 00:02:16,760 --> 00:02:21,680 Good. You need something official or at work, right? This is me 28 00:02:21,680 --> 00:02:22,020 giving you a picture of a picture of a picture of a picture of a picture of a picture of a picture of 29 00:02:22,020 --> 00:02:22,140 a picture of a picture of a picture of a picture of a picture of a picture of a picture of a picture 30 00:02:22,140 --> 00:02:27,520 giving a different talk at Kaspersky SASS last year. And last but not least, you need 31 00:02:27,520 --> 00:02:31,120 something that is silly or creative that shows that you're a fun person to 32 00:02:31,120 --> 00:02:37,000 be with, and this if, I don't know if Robert was there. This is last year's Kaspersky party. 33 00:02:37,940 --> 00:02:43,680 I don't remember this photo, but I have it, so there you go. All right, so I got this 34 00:02:43,680 --> 00:02:49,020 covered. The story starts in Copenhagen. I was there for a conference, CISO Europe. It was 35 00:02:49,680 --> 00:02:51,300 May last year, right? 36 00:02:52,020 --> 00:02:56,720 And I start getting, I'm using Tinder, and I see a lot of beautiful women. 37 00:02:57,580 --> 00:02:58,820 You can see all these. 38 00:02:59,700 --> 00:03:02,420 Yes, that's my thoughts exactly, right? 39 00:03:04,280 --> 00:03:10,200 Now, don't mind the ages, because as a researcher, I like to expose myself to a lot of data. 40 00:03:10,880 --> 00:03:15,940 And then I start getting matches, right? 41 00:03:16,040 --> 00:03:16,640 It's cool. 42 00:03:17,020 --> 00:03:21,340 And not just one, like a bunch of them, all at one time. 43 00:03:22,580 --> 00:03:24,120 So the first match is Adrienne. 44 00:03:24,180 --> 00:03:28,140 She's 21, an interior designer, and she sends me a message in Danish. 45 00:03:28,540 --> 00:03:35,460 Now, I have a Danish girlfriend, so I know a little bit of Danish, but I'm also a security researcher, and there's a link here. 46 00:03:35,540 --> 00:03:37,480 So that's, you know, no way. 47 00:03:37,580 --> 00:03:38,300 It's not happening. 48 00:03:38,500 --> 00:03:39,440 Let me show you this. 49 00:03:39,500 --> 00:03:42,320 Anybody speaks Danish here, or any other of the Scandinavian languages? 50 00:03:42,920 --> 00:03:45,080 You see, I knew that, so I translated this for you. 51 00:03:46,180 --> 00:03:49,240 I just got out of a bad breakup with my boyfriend, and I want to forget it. 52 00:03:49,300 --> 00:03:51,460 I'm totally a sex addict, blah, blah, blah. 53 00:03:52,180 --> 00:03:53,040 Click the link. 54 00:03:53,800 --> 00:03:55,140 Not going to happen, all right? 55 00:03:55,740 --> 00:03:57,740 It turns out that I'm very popular, right? 56 00:03:57,800 --> 00:04:06,500 So I thought maybe because this is Europe, and I'm Middle Eastern, you know, all sexy stranger stuff, and I'm getting many, many, many matches, right? 57 00:04:07,360 --> 00:04:09,740 And as you can see, they're all sending me the same message. 58 00:04:11,520 --> 00:04:13,700 And this is where I got suspicious. 59 00:04:15,760 --> 00:04:17,240 So the Israelis know this. 60 00:04:17,240 --> 00:04:19,300 This is a, right? 61 00:04:19,660 --> 00:04:20,860 But for other people. 62 00:04:22,020 --> 00:04:23,360 And here's the coincidence. 63 00:04:23,560 --> 00:04:24,620 I don't think so, right? 64 00:04:25,440 --> 00:04:29,120 Turns out that I matched with 57 different profiles, right? 65 00:04:29,200 --> 00:04:31,740 At this time, my researcher instincts kicked in. 66 00:04:31,820 --> 00:04:35,460 I recognized the patterns, and I started, you know, taking screenshots. 67 00:04:35,600 --> 00:04:36,400 It's rather easy. 68 00:04:36,580 --> 00:04:39,820 On your iPhone, you just take a screenshot, and then you can do the research later. 69 00:04:39,980 --> 00:04:41,620 I matched 57 bots. 70 00:04:42,660 --> 00:04:46,100 They had 29 places of education, 26 places of work. 71 00:04:46,240 --> 00:04:47,080 Okay, fair enough. 72 00:04:47,140 --> 00:04:48,300 That's almost a one to two ratio. 73 00:04:48,460 --> 00:04:50,040 But only 11 professions. 74 00:04:50,840 --> 00:04:51,800 57 different. 75 00:04:52,020 --> 00:04:54,660 People, allegedly, and they share 11 different professions. 76 00:04:54,860 --> 00:04:56,600 That is statistically improbable. 77 00:04:57,500 --> 00:04:59,140 These are the professions, right? 78 00:04:59,600 --> 00:05:01,760 PR and communications, flight attendants. 79 00:05:01,760 --> 00:05:02,720 That actually makes sense. 80 00:05:02,800 --> 00:05:04,840 You think to yourself, okay, she's traveling a lot. 81 00:05:04,960 --> 00:05:05,920 Maybe she doesn't have a boyfriend. 82 00:05:06,120 --> 00:05:07,160 She likes to fool around. 83 00:05:07,360 --> 00:05:09,260 The boyfriend at every port, as they say. 84 00:05:09,820 --> 00:05:12,360 But, you know, and I started mapping them. 85 00:05:12,440 --> 00:05:13,540 These are the places of education. 86 00:05:13,800 --> 00:05:14,600 Let's look at the map. 87 00:05:14,920 --> 00:05:21,240 If you look at places of education, with one exception that was in France, they are all actually in Denmark, right? 88 00:05:21,300 --> 00:05:21,660 So this. 89 00:05:22,020 --> 00:05:23,980 Kind of matches the cover story. 90 00:05:24,900 --> 00:05:31,700 However, if you look at the place of work, with the exception of one that is in the U.S., they're actually all in Britain. 91 00:05:32,140 --> 00:05:34,980 And with the exception of one, they're all in London. 92 00:05:35,300 --> 00:05:37,340 So that doesn't make sense. 93 00:05:37,440 --> 00:05:42,660 Like this whole group of 57 people, women, they all got certified in England? 94 00:05:43,840 --> 00:05:44,980 What happens there? 95 00:05:45,320 --> 00:05:45,840 Right? 96 00:05:46,000 --> 00:05:50,980 So, obviously, these are stolen identities, and you start noticing that very quickly. 97 00:05:50,980 --> 00:05:52,640 Let's look at those, right? 98 00:05:54,200 --> 00:05:58,140 Since at least one of you is seeing Tinder for the first time, this is a photo. 99 00:05:58,540 --> 00:05:59,640 This is her name. 100 00:06:00,040 --> 00:06:04,460 Basically, logging on to Tinder is done with your Facebook profile, right? 101 00:06:04,520 --> 00:06:07,140 It's a Facebook logon. 102 00:06:07,320 --> 00:06:14,260 So you have a name, an age that comes from your Facebook profile, profession and education. 103 00:06:14,380 --> 00:06:16,160 If you choose to share it, you don't have to. 104 00:06:16,260 --> 00:06:17,360 And then free text. 105 00:06:17,540 --> 00:06:17,740 Okay? 106 00:06:17,780 --> 00:06:20,580 Everything below the line is a free text. 107 00:06:21,100 --> 00:06:26,520 Now, mind you, as you can see, the distance here, this one was 349 kilometers away. 108 00:06:26,860 --> 00:06:30,840 Tinder offers you, when you pay for the service, otherwise it's free. 109 00:06:30,960 --> 00:06:33,660 When you pay for it, you can check into a location before you get there. 110 00:06:34,340 --> 00:06:37,580 Which is kind of good, because if I go to Copenhagen and I'm only there for three days, 111 00:06:37,720 --> 00:06:40,720 I want to get a match and set a date before I get there, right? 112 00:06:41,400 --> 00:06:43,360 So, basically, I'm getting paid to use Tinder. 113 00:06:43,460 --> 00:06:44,080 That's kind of nice. 114 00:06:45,580 --> 00:06:50,120 But, all of a sudden, you start seeing that while the profiles bear a name and an age, 115 00:06:50,300 --> 00:06:50,960 it doesn't matter. 116 00:06:50,960 --> 00:06:52,460 It does not match the free text, right? 117 00:06:52,700 --> 00:06:55,940 She calls herself Ariel, but this is actually Cecil. 118 00:06:56,260 --> 00:06:59,260 She says she's Lily, but here it says Camilla, 24. 119 00:06:59,780 --> 00:07:00,220 Right? 120 00:07:00,280 --> 00:07:03,900 This one is called Delfina, but the Instagram is Emily. 121 00:07:04,140 --> 00:07:04,460 Right? 122 00:07:04,540 --> 00:07:05,160 It doesn't match. 123 00:07:05,320 --> 00:07:06,220 This is stolen information. 124 00:07:07,720 --> 00:07:09,240 So, let's track a couple of those. 125 00:07:10,660 --> 00:07:11,100 Kylie? 126 00:07:11,960 --> 00:07:12,400 No. 127 00:07:12,960 --> 00:07:13,840 Hele Thingod. 128 00:07:14,020 --> 00:07:14,340 Okay? 129 00:07:14,600 --> 00:07:18,800 This is the free text that is being copied from a different profile. 130 00:07:18,980 --> 00:07:19,360 Right? 131 00:07:19,480 --> 00:07:20,940 So, if you look at the Instagram profile, you can see that this is a free text. 132 00:07:20,960 --> 00:07:23,920 So, if you look at the Instagram profile, you will see it's not the same woman, right? 133 00:07:24,720 --> 00:07:28,520 Also, on Facebook, same woman here, not the same one here. 134 00:07:29,320 --> 00:07:31,620 Another example, Latrice. 135 00:07:33,140 --> 00:07:37,180 I'm not an expert on names, but I think, isn't Latrice like African American commonly? 136 00:07:37,420 --> 00:07:38,180 Something like that? 137 00:07:38,740 --> 00:07:42,540 I'm not an expert, but in any case, neither one of them looks like a Latrice. 138 00:07:42,920 --> 00:07:45,100 And the Instagram says Olivia Meyer. 139 00:07:45,420 --> 00:07:49,340 So, if you go on Instagram and on Facebook, there is an Olivia Meyer. 140 00:07:49,480 --> 00:07:50,740 It's just neither one of these two. 141 00:07:50,960 --> 00:07:51,040 Right? 142 00:07:51,080 --> 00:07:57,260 So, we now know that they take photos, they match it up with fake identification, and 143 00:07:57,260 --> 00:08:01,520 they use real text written by real women because apparently they figured out it was harder 144 00:08:01,520 --> 00:08:02,200 to fake that. 145 00:08:02,340 --> 00:08:05,940 Better take someone a real person wrote because it's more compelling. 146 00:08:06,120 --> 00:08:06,460 Right? 147 00:08:07,460 --> 00:08:08,740 So, next conference. 148 00:08:08,880 --> 00:08:11,060 This is all me traveling to security conferences. 149 00:08:11,120 --> 00:08:11,820 Just like this one. 150 00:08:12,120 --> 00:08:13,280 So, I went to Denver. 151 00:08:13,380 --> 00:08:16,200 There was another conference in Denver, Virus Bulletin, if anyone knows it. 152 00:08:16,240 --> 00:08:16,980 Probably Robert does. 153 00:08:17,520 --> 00:08:20,260 I get to Denver, and this is already the next evolution. 154 00:08:20,260 --> 00:08:24,640 This was a few months later, and now they don't just match you and send you a link. 155 00:08:24,760 --> 00:08:27,740 They actually try to get you to do stuff. 156 00:08:27,960 --> 00:08:32,440 So, she sends me a message right away, and it's very blunt, right? 157 00:08:33,900 --> 00:08:37,180 You want to, nah, let's make plan, bit.ly. 158 00:08:37,420 --> 00:08:38,940 Once again, I'm a security researcher. 159 00:08:39,220 --> 00:08:42,140 I don't click links, certainly not those that are bit.ly. 160 00:08:42,280 --> 00:08:45,340 Although bit.ly is kind of cool because you can figure out where it goes to. 161 00:08:45,760 --> 00:08:48,160 This is a redirection service. 162 00:08:48,520 --> 00:08:50,240 And you end up going to the server. 163 00:08:50,260 --> 00:08:52,760 You're going to dailysexx.com. 164 00:08:53,540 --> 00:08:57,900 And this is not a dating site, just in case any had a doubt, right? 165 00:08:58,040 --> 00:09:00,100 And warning, you will see nude photos. 166 00:09:00,300 --> 00:09:01,120 Please be discreet. 167 00:09:03,000 --> 00:09:05,020 And then I get to Chattybots. 168 00:09:05,220 --> 00:09:08,200 They actually run a scripted chat, right? 169 00:09:08,320 --> 00:09:09,800 You say something, they answer back. 170 00:09:10,220 --> 00:09:13,780 But if you're careful enough, you will notice that it doesn't match. 171 00:09:14,080 --> 00:09:17,280 Hey, baby, quite the nocturnal type, are you? 172 00:09:17,340 --> 00:09:19,960 And I was sure she didn't know what nocturnal was, right? 173 00:09:20,260 --> 00:09:21,900 Because I had that feeling. 174 00:09:21,920 --> 00:09:23,100 She was 21 or something. 175 00:09:23,500 --> 00:09:25,640 And she says, I want to go get beers tomorrow. 176 00:09:25,860 --> 00:09:26,520 This is a Sunday. 177 00:09:27,180 --> 00:09:28,940 And I said, how about Tuesday? 178 00:09:29,600 --> 00:09:31,320 And she said, do you want to go out with me? 179 00:09:31,380 --> 00:09:35,980 Now, notice how pretty much whatever I say makes her next line plausible. 180 00:09:36,320 --> 00:09:37,360 That's how it's scripted. 181 00:09:37,880 --> 00:09:39,360 And I said, so what if I do? 182 00:09:40,180 --> 00:09:41,840 And she says, request me on Skype. 183 00:09:41,940 --> 00:09:42,700 Let's make plans. 184 00:09:42,840 --> 00:09:43,620 My name there is. 185 00:09:43,800 --> 00:09:45,520 And there's a Skype ID. 186 00:09:45,800 --> 00:09:49,080 Now, I already figured that I was going to get spanned there, so I didn't go there. 187 00:09:49,140 --> 00:09:49,880 But remember this. 188 00:09:49,880 --> 00:09:51,220 This is going to come back later. 189 00:09:52,560 --> 00:09:54,000 Then there's another one, Katie. 190 00:09:54,540 --> 00:09:55,800 And she's more sophisticated. 191 00:09:55,980 --> 00:09:57,220 Katie is allegedly 23. 192 00:09:57,640 --> 00:09:58,320 Hi, Amber. 193 00:09:58,400 --> 00:09:59,680 Just found your match from Tinder. 194 00:09:59,800 --> 00:10:00,880 Somewhat bored at home. 195 00:10:01,000 --> 00:10:02,880 Where part of town you at? 196 00:10:03,460 --> 00:10:06,280 So I don't know if you guys are old enough. 197 00:10:06,520 --> 00:10:09,980 There used to be a, maybe there still is, I'm not American, jive. 198 00:10:10,060 --> 00:10:12,000 That sounds a little bit like jive, right? 199 00:10:12,340 --> 00:10:14,960 So by this time, I'm pretty certain I'm speaking to a bot. 200 00:10:15,360 --> 00:10:18,900 Nonetheless, I say I'm in the CBD, Central Business District. 201 00:10:20,140 --> 00:10:20,580 Nice. 202 00:10:20,880 --> 00:10:22,240 Of course she's there, right? 203 00:10:22,320 --> 00:10:23,380 Doesn't matter what you say. 204 00:10:23,740 --> 00:10:24,400 Excuse me. 205 00:10:24,480 --> 00:10:25,380 She's going to be there. 206 00:10:25,560 --> 00:10:26,760 What's your favorite color? 207 00:10:27,300 --> 00:10:28,820 The color of a boarding pass. 208 00:10:29,340 --> 00:10:31,140 You would expect her to say, huh? 209 00:10:31,360 --> 00:10:31,800 What? 210 00:10:32,180 --> 00:10:32,620 No. 211 00:10:32,700 --> 00:10:34,040 She says, mine red. 212 00:10:34,360 --> 00:10:34,980 Suits me. 213 00:10:36,560 --> 00:10:37,000 Right? 214 00:10:37,120 --> 00:10:37,980 Want to make plans. 215 00:10:38,820 --> 00:10:40,160 And this goes on. 216 00:10:40,220 --> 00:10:45,620 And then there's a big explanation on how, I don't care where we meet, but I met some 217 00:10:45,620 --> 00:10:48,700 weirdest people and they started stalking me. 218 00:10:48,700 --> 00:10:54,140 So please go to tinderhverify.com just so I know that you're a real person. 219 00:10:54,280 --> 00:11:00,020 And of course, if you go there, which I did in a VM, you are asked to put in your credit 220 00:11:00,020 --> 00:11:01,700 card information for verification. 221 00:11:02,340 --> 00:11:05,420 And of course, you know the rest, right? 222 00:11:06,820 --> 00:11:11,740 Hamburg, CCC, the Chaos Communication Congress, once again, I was traveling for work. 223 00:11:12,140 --> 00:11:16,540 And at this time, they were starting to get cocky, no pun intended. 224 00:11:16,540 --> 00:11:20,300 They don't, they don't even bother, you know, matching you. 225 00:11:21,240 --> 00:11:21,720 Sorry. 226 00:11:21,920 --> 00:11:26,460 There's already a link at the description, hoping that people who are, let's say, uh, 227 00:11:27,900 --> 00:11:30,060 appealed enough, uh, go there, right? 228 00:11:30,200 --> 00:11:33,660 This goes to yeah, real sex.com. 229 00:11:34,380 --> 00:11:35,600 Where does that lead you? 230 00:11:36,380 --> 00:11:40,680 It's better than Tinder, okay? 231 00:11:40,980 --> 00:11:43,420 And why am I saying that they're getting cocky? 232 00:11:43,500 --> 00:11:45,100 They take themselves so seriously. 233 00:11:45,100 --> 00:11:47,720 Obviously, that they offer you to unsubscribe. 234 00:11:48,180 --> 00:11:53,540 And there's a captcha to make sure that you don't unsubscribe on somebody else's behalf, 235 00:11:53,820 --> 00:11:54,220 right? 236 00:11:55,640 --> 00:12:00,060 Um, Austin, you had another conference, um, and it's getting interesting. 237 00:12:00,920 --> 00:12:03,800 Uh, Shane, oh my God, I'm so bored. 238 00:12:03,980 --> 00:12:05,800 I already know I'm speaking to a bot here. 239 00:12:06,080 --> 00:12:07,240 Uh, me too. 240 00:12:07,940 --> 00:12:08,920 Do you want to Skype? 241 00:12:09,640 --> 00:12:11,380 And what if, uh, why is that? 242 00:12:11,440 --> 00:12:13,500 Do you think this is by the way, a quote from the Princess Bride. 243 00:12:13,580 --> 00:12:14,860 I like the Princess Bride. 244 00:12:15,100 --> 00:12:15,900 I just put in a quote. 245 00:12:16,120 --> 00:12:18,060 And she says, you should message me there. 246 00:12:18,180 --> 00:12:19,620 I can send better pictures. 247 00:12:19,920 --> 00:12:23,540 And then I'm like, ABCDEFGH, just, you know, whatever. 248 00:12:23,880 --> 00:12:28,820 And of course, the script ignores that and that's the Skype ID. 249 00:12:29,060 --> 00:12:30,040 Now, does that look familiar? 250 00:12:31,460 --> 00:12:33,540 Yes, because remember the one from before? 251 00:12:33,720 --> 00:12:34,420 Same thing. 252 00:12:34,500 --> 00:12:35,080 Go to Skype. 253 00:12:35,300 --> 00:12:41,940 My ID there is live, colon, and then a name with the last letter three times and three 254 00:12:41,940 --> 00:12:42,300 digits. 255 00:12:42,580 --> 00:12:42,720 Okay. 256 00:12:42,720 --> 00:12:47,460 So, this time I created a fake Skype profile and I engaged in the chat because by then 257 00:12:47,460 --> 00:12:50,620 it was obvious that I could put this in my presentation, right? 258 00:12:53,100 --> 00:12:54,540 So, yeah, I'm a researcher. 259 00:12:54,560 --> 00:12:54,920 Come on. 260 00:12:55,080 --> 00:12:56,220 I live for this. 261 00:12:56,740 --> 00:13:01,420 Uh, hi, cutie, happy you Skyped me, blah, blah, blah, it doesn't matter what I say. 262 00:13:02,640 --> 00:13:07,760 And, uh, my boyfriend and I broke up recently, blah, blah, I like spanking and choking. 263 00:13:07,840 --> 00:13:08,640 Are you into that? 264 00:13:09,300 --> 00:13:10,180 Not particularly. 265 00:13:10,920 --> 00:13:11,360 Uh. 266 00:13:11,360 --> 00:13:16,060 And then I say, I'm taking screenshots of this conversation, it's going to look great 267 00:13:16,060 --> 00:13:19,300 on the Kaspersky Sass event because I was just going there and it was clear. 268 00:13:19,460 --> 00:13:22,340 And then, I could not direct this conversation better. 269 00:13:22,520 --> 00:13:27,500 As I'm saying to her, or to it, this is going to look good on the Kaspersky Sass event, 270 00:13:27,760 --> 00:13:29,980 it says, hmm, I'm getting wet. 271 00:13:37,020 --> 00:13:37,940 Great success. 272 00:13:39,260 --> 00:13:39,740 Okay. 273 00:13:40,300 --> 00:13:40,780 Vegas. 274 00:13:40,900 --> 00:13:41,260 So. 275 00:13:41,360 --> 00:13:44,420 I got accepted, thank you guys for accepting me to speak here. 276 00:13:44,560 --> 00:13:49,800 I got accepted to Vegas, so obviously I checked in here, I don't know, a couple of weeks ago, 277 00:13:49,960 --> 00:13:55,480 started looking for stuff, and boy, the Tinder scene here, fascinating. 278 00:13:57,000 --> 00:13:59,420 So many fake profiles, you wouldn't believe it. 279 00:13:59,520 --> 00:14:06,140 So the most obvious ones are the service announcements, all the profiles that actually ask you to 280 00:14:06,140 --> 00:14:09,160 go to lookholes.com, okay? 281 00:14:09,220 --> 00:14:10,600 They all have it in the description. 282 00:14:11,360 --> 00:14:15,940 By the way, if you're noticing, if you're seeing these three buttons, it means we haven't 283 00:14:15,940 --> 00:14:16,300 matched. 284 00:14:16,360 --> 00:14:20,900 In Copenhagen, the photos didn't have those because those were all matches, right? 285 00:14:21,040 --> 00:14:24,780 And here, look at the text. 286 00:14:25,300 --> 00:14:26,120 It's identical. 287 00:14:26,240 --> 00:14:29,620 These two, they both say, hey babe, hope you catching you. 288 00:14:30,500 --> 00:14:33,780 Yeah, same text here and here, thanks for viewing my profile. 289 00:14:34,140 --> 00:14:39,260 So this is obviously, it's a fake profile, they're using the same text and their intention, 290 00:14:39,340 --> 00:14:41,280 as you probably understood from the other example. 291 00:14:41,280 --> 00:14:44,880 It's to get the traffic flowing into their website, right? 292 00:14:45,800 --> 00:14:49,200 We have some more, all those, right? 293 00:14:49,300 --> 00:14:50,780 We're already counting eight. 294 00:14:50,960 --> 00:14:52,860 Once again, they all send you to lookholes. 295 00:14:53,040 --> 00:14:54,780 And here, it's a little bit more interesting. 296 00:14:55,680 --> 00:14:59,440 These two are the same, do you like chat with me? 297 00:14:59,640 --> 00:15:02,700 So these guys, they don't speak English as their first language. 298 00:15:02,920 --> 00:15:05,060 This one says, are you bored? 299 00:15:05,240 --> 00:15:08,640 And it says, it spells bored like as a, you know, surfing board. 300 00:15:09,200 --> 00:15:10,500 And that's one thing. 301 00:15:10,500 --> 00:15:13,040 Do you want to sex with me? 302 00:15:15,420 --> 00:15:17,020 Okay, let me consider that. 303 00:15:17,140 --> 00:15:18,300 But this one is more interesting. 304 00:15:18,420 --> 00:15:19,820 She says, I am boring. 305 00:15:22,300 --> 00:15:26,960 And I wasn't sure whether she meant that she was bored or that she's working for Elon 306 00:15:26,960 --> 00:15:28,780 Musk in the boring company. 307 00:15:29,380 --> 00:15:30,700 That's also a possibility. 308 00:15:31,000 --> 00:15:31,960 So yes. 309 00:15:32,300 --> 00:15:34,720 And then we have the usual inconsistencies. 310 00:15:35,540 --> 00:15:39,380 These guys or girls, you can see that the names don't match. 311 00:15:39,380 --> 00:15:42,340 She says, hi, I'm Renita, Sarah. 312 00:15:42,780 --> 00:15:44,920 Hi, I'm Kate, Esther. 313 00:15:45,540 --> 00:15:48,260 Becca, 20, New Jersey, Zoe, 28. 314 00:15:48,440 --> 00:15:50,480 So that's very easy to see. 315 00:15:51,040 --> 00:15:55,520 And then we have those that actually have handles to other services. 316 00:15:55,640 --> 00:15:57,680 That makes it easier to check, right? 317 00:15:57,780 --> 00:16:02,640 So this girl gives us her Twitter account, EMMYYY. 318 00:16:02,860 --> 00:16:06,460 But if you go there, that's a different woman, right? 319 00:16:07,780 --> 00:16:08,820 Emily McDonough. 320 00:16:08,840 --> 00:16:09,360 And this is different. 321 00:16:09,380 --> 00:16:09,540 This is Jessie. 322 00:16:09,820 --> 00:16:11,000 Not the same person. 323 00:16:11,460 --> 00:16:12,840 And this is even funnier. 324 00:16:12,920 --> 00:16:14,140 This is Evelyn, 27. 325 00:16:14,920 --> 00:16:19,200 Her Instagram is Krisa something, whatever. 326 00:16:19,460 --> 00:16:25,160 But when you go there, it says, no, I am not Julie from Tinder. 327 00:16:27,400 --> 00:16:29,960 And just so you know, she says she's not Julie. 328 00:16:30,080 --> 00:16:30,780 This is not Julie. 329 00:16:30,880 --> 00:16:31,440 This is Evelyn. 330 00:16:31,580 --> 00:16:36,900 So these guys are using the same stolen text over multiple fake profiles, right? 331 00:16:37,100 --> 00:16:38,140 This is getting cool. 332 00:16:38,140 --> 00:16:40,380 So tracking the infrastructure. 333 00:16:40,720 --> 00:16:44,240 Up until now, this was just information gathering, a lot of screenshots. 334 00:16:44,540 --> 00:16:45,940 But let's see who's behind this. 335 00:16:46,860 --> 00:16:49,320 This is the original message from Copenhagen. 336 00:16:49,360 --> 00:16:51,120 And we have this little link here. 337 00:16:51,880 --> 00:16:53,400 Very simple research tools. 338 00:16:53,500 --> 00:16:55,320 Most of the AV guys know those. 339 00:16:55,980 --> 00:16:56,860 You go to VirusTotal. 340 00:16:57,040 --> 00:17:03,660 Let's see what other domains are in this IP address or where it belongs, who it belongs to, where it is hosted. 341 00:17:04,060 --> 00:17:07,860 And it turns out that many different domains are hosted on the same IP. 342 00:17:07,860 --> 00:17:09,680 As that MeetDutch. 343 00:17:09,820 --> 00:17:11,640 And they're all registered to the same person. 344 00:17:12,240 --> 00:17:13,520 MeetDutch is somewhere in here. 345 00:17:14,460 --> 00:17:17,340 Altogether, there were about 60 something. 346 00:17:17,800 --> 00:17:20,920 Now, MeetDutch is protected with WhoisGuard. 347 00:17:21,040 --> 00:17:22,260 We don't know who it belongs to. 348 00:17:23,380 --> 00:17:30,660 But seven out of 61 domains that were registered to the same IP were not being protected by WhoisGuard. 349 00:17:30,820 --> 00:17:36,040 Probably because they were registered in certain countries that didn't offer that option or certain registration services. 350 00:17:36,240 --> 00:17:37,260 I don't know for sure. 351 00:17:37,860 --> 00:17:38,460 Let's look at those. 352 00:17:38,540 --> 00:17:41,820 The first one is by a WhoisGuard but a different one. 353 00:17:41,920 --> 00:17:42,760 So, no help here. 354 00:17:43,040 --> 00:17:45,880 This one in Sweden doesn't give enough information. 355 00:17:46,380 --> 00:17:49,900 And then DanishGirl.dk. 356 00:17:50,220 --> 00:17:53,300 All of a sudden, we have a name, an address, and a phone number. 357 00:17:53,500 --> 00:17:56,060 Now, a quick look will show you that these are fake as well. 358 00:17:56,280 --> 00:17:58,800 The number 234578. 359 00:18:00,140 --> 00:18:03,460 Marseille, actually, the zip code of Marseille starts with 13. 360 00:18:03,880 --> 00:18:05,520 So, this is not Marseille. 361 00:18:05,580 --> 00:18:07,080 It's a fake address as well. 362 00:18:07,860 --> 00:18:10,740 But the next one actually has an email. 363 00:18:10,920 --> 00:18:12,800 And that is something that we can work with. 364 00:18:13,460 --> 00:18:17,280 Once again, Edward Serkov. 365 00:18:18,400 --> 00:18:19,260 Greg752 at Gmail. 366 00:18:19,480 --> 00:18:20,160 A bunch of those. 367 00:18:20,320 --> 00:18:23,040 They're all registered under the same email. 368 00:18:24,540 --> 00:18:26,100 Now, how do we connect the dots? 369 00:18:26,180 --> 00:18:28,960 Because I've shown you examples from a number of cities, right? 370 00:18:29,140 --> 00:18:34,460 If you look at ScamAdvisor and you look at MeetGirls.at and MeetDutch, 371 00:18:34,460 --> 00:18:38,480 you see these two are from the first bunch, right? 372 00:18:38,560 --> 00:18:39,240 From Copenhagen. 373 00:18:39,360 --> 00:18:43,040 But they are both redirecting to DailySex, which came later. 374 00:18:43,160 --> 00:18:44,340 I think it was Austin, right? 375 00:18:44,740 --> 00:18:46,760 They both redirect to the same place. 376 00:18:46,820 --> 00:18:47,780 So, you know they're connected. 377 00:18:48,120 --> 00:18:49,680 Now, what was DailySex? 378 00:18:51,680 --> 00:18:52,880 This guy, right? 379 00:18:53,120 --> 00:18:54,080 So, they're connected. 380 00:18:54,280 --> 00:18:55,280 So, we know they're all connected. 381 00:18:55,500 --> 00:19:02,940 All the sites from Copenhagen are connected to the site that I met later in a different city across the Atlantic, right? 382 00:19:04,460 --> 00:19:09,620 And, of course, it's also protected, so we don't know who controls it. 383 00:19:09,880 --> 00:19:13,720 And I was trying to track this guy, but he did his best not to be detected. 384 00:19:14,340 --> 00:19:22,200 There's another website owned by the same email, but this time the name is different, right? 385 00:19:22,480 --> 00:19:25,740 It's still fake information. 386 00:19:25,920 --> 00:19:28,380 Same phone number, though, but different address. 387 00:19:29,040 --> 00:19:29,800 Still fake. 388 00:19:29,860 --> 00:19:31,640 So, I don't really know who this guy is. 389 00:19:32,120 --> 00:19:34,280 If you know how to do it. 390 00:19:34,460 --> 00:19:36,640 If you can help me track him down, that would be nice. 391 00:19:36,680 --> 00:19:38,840 Feel free to contact me after the talk. 392 00:19:39,800 --> 00:19:44,220 So, I figured if this happens on Tinder, that also happens on other platforms. 393 00:19:45,060 --> 00:19:46,980 So, I registered to a bunch of platforms. 394 00:19:47,700 --> 00:19:52,800 Not to say that I was already registered to some of them before, but all in the name of research. 395 00:19:52,980 --> 00:19:55,320 And then I got this message on OkCupid. 396 00:19:55,920 --> 00:20:02,240 It's an unsolicited message from a profile that I did not look at, didn't have any match with, 0% match ratio. 397 00:20:02,980 --> 00:20:04,280 And it just says, 398 00:20:04,460 --> 00:20:10,300 Hi, I found a free dating site, way better than OkCupid, with more members, and I just wanted to share it with you. 399 00:20:10,540 --> 00:20:12,220 Wow, I feel so lucky. 400 00:20:12,460 --> 00:20:13,140 Thank you. 401 00:20:13,360 --> 00:20:15,080 So, that's the profile. 402 00:20:15,680 --> 00:20:17,880 Within a couple of hours, it's gone. 403 00:20:18,060 --> 00:20:18,500 Right? 404 00:20:18,720 --> 00:20:19,700 But I have a lead. 405 00:20:19,860 --> 00:20:23,520 It's called whereifindloveluv.com. 406 00:20:24,120 --> 00:20:24,560 Okay? 407 00:20:25,100 --> 00:20:25,840 Let's go there. 408 00:20:26,340 --> 00:20:28,100 And it really looks bad. 409 00:20:28,320 --> 00:20:29,540 It's so unprofessional. 410 00:20:30,180 --> 00:20:33,700 The name and the description and the name on the website. 411 00:20:33,700 --> 00:20:34,780 They're not identical. 412 00:20:35,080 --> 00:20:36,880 One says love, L-U-V. 413 00:20:37,020 --> 00:20:38,700 One says love, L-O-V-E. 414 00:20:39,120 --> 00:20:40,980 And the English is really bad. 415 00:20:41,140 --> 00:20:43,640 You can't see it here because of the projection. 416 00:20:43,780 --> 00:20:45,620 But this is bad English. 417 00:20:45,880 --> 00:20:48,180 So, either way, this is not a real website. 418 00:20:48,700 --> 00:20:52,020 And, you know, once again, I start tracking that. 419 00:20:52,080 --> 00:20:55,960 If you look at this domain, it leads to this IP address. 420 00:20:56,080 --> 00:21:02,880 And if you do a reverse lookup on the IP address, there are a bunch more domain names that they all pretty much sound the same. 421 00:21:02,880 --> 00:21:05,140 Like some lame-ass dating site. 422 00:21:05,300 --> 00:21:06,500 So, I picked one of those. 423 00:21:07,720 --> 00:21:08,680 Passionfoundhere.com. 424 00:21:08,940 --> 00:21:09,420 Right? 425 00:21:10,180 --> 00:21:15,340 They're more or less all registered within about eight weeks of each other. 426 00:21:15,480 --> 00:21:16,440 So, they're all connected. 427 00:21:16,760 --> 00:21:18,960 So, let's go to passionfoundhere.com. 428 00:21:19,800 --> 00:21:24,040 Passionfoundhere.com is registered to this guy. 429 00:21:24,640 --> 00:21:28,360 Montrell Newble from Silver Spring, Maryland. 430 00:21:29,280 --> 00:21:29,760 Okay. 431 00:21:29,800 --> 00:21:30,260 This is nice. 432 00:21:30,300 --> 00:21:31,660 And once again, we have an email address. 433 00:21:32,380 --> 00:21:32,860 Computer. 434 00:21:32,880 --> 00:21:34,840 Computertechnicals at yahoo.com. 435 00:21:35,460 --> 00:21:38,320 Now, that sounds like something you would actually use. 436 00:21:38,560 --> 00:21:42,040 So, we were starting to shift over into the bad OPSEC world. 437 00:21:42,760 --> 00:21:45,960 Let's look up this email address on Facebook. 438 00:21:46,440 --> 00:21:47,320 Guess what? 439 00:21:48,300 --> 00:21:51,040 There's a profile registered by that email address. 440 00:21:52,660 --> 00:21:53,480 Devon Green. 441 00:21:54,640 --> 00:21:54,920 Okay. 442 00:21:54,980 --> 00:22:00,100 So, now we have a problem because here it says Montrell Newble and this says Devon Green. 443 00:22:00,600 --> 00:22:01,940 How do we match them? 444 00:22:01,940 --> 00:22:03,620 How do you know it's the same person? 445 00:22:04,220 --> 00:22:10,100 Well, thank the American judicial system, free public court records. 446 00:22:10,940 --> 00:22:12,100 It's the same guy. 447 00:22:12,200 --> 00:22:14,920 Montrell Devon Newble. 448 00:22:15,680 --> 00:22:16,400 Same person. 449 00:22:16,540 --> 00:22:17,200 Right? 450 00:22:17,960 --> 00:22:20,060 From Silver Spring, Maryland. 451 00:22:20,680 --> 00:22:21,580 How nice. 452 00:22:21,880 --> 00:22:27,300 Now, what do you never ever do on Facebook when you're a criminal? 453 00:22:29,300 --> 00:22:31,420 Take a photo with a lot of money. 454 00:22:32,080 --> 00:22:33,320 You never do that. 455 00:22:33,400 --> 00:22:35,900 All the people that do that end up getting caught. 456 00:22:37,240 --> 00:22:41,540 Now, the question is how hard is it to operate such, you know, a scam? 457 00:22:41,980 --> 00:22:43,160 Well, it's not. 458 00:22:44,100 --> 00:22:48,560 We're talking at Perimeter X, we're talking about four generations of bots, right? 459 00:22:48,660 --> 00:22:51,880 A bot is anything that is not human, anything that is automatic. 460 00:22:52,840 --> 00:22:54,980 Generation one is just a script, right? 461 00:22:55,040 --> 00:22:56,480 Or a command line tool. 462 00:22:56,480 --> 00:22:59,060 You can run CURL or WGET. 463 00:22:59,380 --> 00:23:01,540 There's a simple interaction, HTTP GET. 464 00:23:01,660 --> 00:23:02,480 You get whatever you want. 465 00:23:02,560 --> 00:23:02,980 That's it. 466 00:23:03,700 --> 00:23:07,500 Generation two can store a cookie, right? 467 00:23:07,560 --> 00:23:09,380 So you can maintain a session. 468 00:23:09,580 --> 00:23:12,800 Maybe you logged on or maybe you need some authentication. 469 00:23:13,300 --> 00:23:14,280 But that's it. 470 00:23:14,340 --> 00:23:14,980 There's no JavaScript. 471 00:23:15,400 --> 00:23:22,420 Generation three already adds JavaScript and you can do engine automation like Selenium. 472 00:23:22,480 --> 00:23:25,180 You can run that or PhantomJS. 473 00:23:25,420 --> 00:23:26,460 And the JavaScript. 474 00:23:26,480 --> 00:23:30,360 Generation four, these are actually malware running on top of real browsers. 475 00:23:30,580 --> 00:23:38,340 So some of the time it will be the original user creating traffic but some of the time it will be we were mostly seeing malicious extensions doing that. 476 00:23:38,600 --> 00:23:40,480 You know what it takes to do this? 477 00:23:40,680 --> 00:23:41,460 Gen two. 478 00:23:41,580 --> 00:23:48,180 All you need is the ability to authenticate against the Tinder UI or API, sorry, and that's it. 479 00:23:48,540 --> 00:23:52,420 So this can all be done in a Python script for all you care. 480 00:23:53,440 --> 00:23:55,940 Now, what is the result of this being so easy? 481 00:23:55,940 --> 00:24:01,420 Not just the scams that we're seeing but you also have dating site automation. 482 00:24:01,740 --> 00:24:03,480 But it can be good and it can be bad. 483 00:24:03,680 --> 00:24:09,860 You can find the good side of a guy writing an article about how he created a bot to find love. 484 00:24:10,220 --> 00:24:11,840 And I have a friend who did the same. 485 00:24:12,080 --> 00:24:23,580 He wrote a bot that created many fake profiles and then measured the matches that he got from women and then figured out what, you know, he needed to become in order. 486 00:24:24,900 --> 00:24:25,920 You see where I'm going? 487 00:24:25,920 --> 00:24:32,820 But at the same time, there is a service that you can do that does that for you. 488 00:24:33,260 --> 00:24:33,740 Right? 489 00:24:33,840 --> 00:24:38,280 Like dating as a service or matchmaking as a service. 490 00:24:38,480 --> 00:24:42,160 And, of course, that is against the interest of the dating site services. 491 00:24:43,320 --> 00:24:44,800 So why do we care? 492 00:24:45,240 --> 00:24:48,100 Because theoretically you can say, okay, big deal. 493 00:24:49,060 --> 00:24:51,140 So you got caught on Tinder. 494 00:24:51,340 --> 00:24:55,900 Well, first of all, it hurts people's lives. 495 00:24:55,920 --> 00:24:57,500 It hurts their reputation, the website reputation. 496 00:24:57,940 --> 00:25:02,100 Now you know when you go on Tinder, if you go on Tinder, you're going to be a lot more suspicious. 497 00:25:02,300 --> 00:25:04,780 You're going to know that there's a good chance that what you're seeing is not real. 498 00:25:06,500 --> 00:25:10,700 Some of the services, they attract traffic out of the other ones. 499 00:25:10,960 --> 00:25:11,260 Right? 500 00:25:11,660 --> 00:25:16,060 And actually the worst thing is that people actually click the links. 501 00:25:16,520 --> 00:25:18,840 So at Perimeter X, we did a simple test. 502 00:25:18,920 --> 00:25:24,960 We created a fake profile on one of the dating sites and added just two photos of a gorgeous woman. 503 00:25:24,960 --> 00:25:26,340 And then we waited. 504 00:25:26,600 --> 00:25:27,120 Right? 505 00:25:27,180 --> 00:25:28,360 We didn't even message anyone. 506 00:25:28,460 --> 00:25:30,420 We waited for people to message us. 507 00:25:30,780 --> 00:25:35,900 Those who messaged us got back a message containing nothing but a link. 508 00:25:36,560 --> 00:25:40,920 Who would like to guess the click rate, the conversion rate on the link we sent? 509 00:25:41,640 --> 00:25:42,680 Seventy percent. 510 00:25:44,940 --> 00:25:48,780 Seventy percent of the people that sent us a message got the link. 511 00:25:49,140 --> 00:25:53,440 Now I will concede to the option that some of them are other security researchers. 512 00:25:53,440 --> 00:25:55,000 That is a possibility. 513 00:25:55,440 --> 00:25:56,400 I don't know. 514 00:25:56,840 --> 00:26:00,540 But this is the best conversion rate I have ever heard of. 515 00:26:00,940 --> 00:26:01,000 Right? 516 00:26:01,460 --> 00:26:08,420 Ad agencies would pay good money to get this conversion rate. 517 00:26:08,500 --> 00:26:09,300 No one else has. 518 00:26:09,640 --> 00:26:11,460 But that's only part of the problem. 519 00:26:12,680 --> 00:26:14,260 This is a security breach. 520 00:26:14,800 --> 00:26:20,180 If you'll notice, most of the discussion, let's put hardware aside. 521 00:26:20,460 --> 00:26:23,420 Most of the discussion in the security community revolves around this. 522 00:26:23,440 --> 00:26:24,000 It revolves around the breach. 523 00:26:24,140 --> 00:26:25,760 What happens when you get breached? 524 00:26:25,960 --> 00:26:27,140 How you got breached? 525 00:26:27,380 --> 00:26:29,320 What happens when you are breached? 526 00:26:29,480 --> 00:26:34,720 Lateral movement, data exfiltration, the whole shebang, forensics and everything. 527 00:26:34,980 --> 00:26:39,980 But there is so much that can be done by malicious web activity that doesn't even involve 528 00:26:39,980 --> 00:26:40,380 breach. 529 00:26:40,580 --> 00:26:43,260 It doesn't even involve exploiting vulnerabilities. 530 00:26:44,100 --> 00:26:46,900 Just web automation can cause so much damage. 531 00:26:47,220 --> 00:26:51,600 This entire Tinder operation is caused or is operated by web automation. 532 00:26:51,600 --> 00:26:59,200 Someone is using a script or maybe a script over a mobile phone emulator, probably an 533 00:26:59,200 --> 00:27:03,860 Android, to do all this, to create fake profiles, to feed them with information. 534 00:27:04,140 --> 00:27:05,400 This is all done automatically. 535 00:27:05,520 --> 00:27:07,880 And the damage can be extensive. 536 00:27:08,220 --> 00:27:11,180 So it's not all about the breach. 537 00:27:11,300 --> 00:27:12,360 And we need to remember that. 538 00:27:12,580 --> 00:27:16,840 And what we're trying to do or what I was trying to do at Parameter X is to shift the 539 00:27:17,220 --> 00:27:21,580 discussion a little bit back to, okay, breach is nice, but there's also a breach. 540 00:27:21,600 --> 00:27:25,080 There's also a lot of damage that can happen that does not involve breach. 541 00:27:25,300 --> 00:27:27,040 And with this, I finish. 542 00:27:27,140 --> 00:27:30,160 If you have any questions, we have three minutes. 543 00:27:30,360 --> 00:27:30,760 Go ahead. 544 00:27:30,980 --> 00:27:33,540 How much automation do you employ in your discovery? 545 00:27:34,280 --> 00:27:34,800 None. 546 00:27:35,000 --> 00:27:36,060 I enjoy it. 547 00:27:36,060 --> 00:27:36,520 I do it myself. 548 00:27:36,760 --> 00:27:37,000 Really? 549 00:27:37,140 --> 00:27:37,440 Yeah. 550 00:27:37,660 --> 00:27:41,360 I can show you the screenshots on my laptop. 551 00:27:43,000 --> 00:27:48,840 Getting a match on Tinder, it's like winning the lottery. 552 00:27:49,800 --> 00:27:51,120 And you know it's fake. 553 00:27:51,240 --> 00:27:51,480 Right? 554 00:27:51,600 --> 00:27:52,440 And I'm looking for the fake. 555 00:27:52,500 --> 00:27:53,300 We're like, ding. 556 00:27:53,480 --> 00:27:53,720 Yeah. 557 00:27:53,840 --> 00:27:54,440 I got it. 558 00:27:54,920 --> 00:27:56,140 So, yeah, I do it myself. 559 00:27:56,640 --> 00:27:57,040 Yes? 560 00:27:57,460 --> 00:27:59,700 So what was the percentage of bots versus real people? 561 00:28:00,320 --> 00:28:01,240 It's not a lot. 562 00:28:02,160 --> 00:28:08,800 Let's say Copenhagen, I found 57 fake profiles out of, I don't know, let's say there are 563 00:28:08,800 --> 00:28:10,100 a few thousand profiles there. 564 00:28:10,520 --> 00:28:12,100 So by numbers, it's not a lot. 565 00:28:12,200 --> 00:28:14,240 But look at the worst case scenario. 566 00:28:14,580 --> 00:28:15,820 You get sent a link. 567 00:28:16,160 --> 00:28:18,420 And that link doesn't lead you to a competing website. 568 00:28:18,540 --> 00:28:21,580 It leads you to a malicious website. 569 00:28:21,580 --> 00:28:22,800 This website running an exploit kit. 570 00:28:23,580 --> 00:28:28,840 If I can later prove that I was infected by a link sent over the Tinder profile, that 571 00:28:28,840 --> 00:28:31,660 could put Tinder in a liability spot they don't want to be. 572 00:28:31,860 --> 00:28:35,660 So even if the numbers are small, and the more I travel and I see more, the numbers 573 00:28:35,660 --> 00:28:38,680 are not so small, especially not in Vegas, by the way. 574 00:28:38,700 --> 00:28:39,660 The percentage here is amazing. 575 00:28:40,020 --> 00:28:42,340 This could have ramifications for all parties involved. 576 00:28:43,220 --> 00:28:43,960 Yeah, one more. 577 00:28:44,160 --> 00:28:44,560 Yes? 578 00:28:44,740 --> 00:28:47,400 Did you catch that guy or did that guy get caught? 579 00:28:47,540 --> 00:28:47,860 Not yet. 580 00:28:47,900 --> 00:28:48,980 Not Greg752. 581 00:28:48,980 --> 00:28:54,740 So if any one of you can help me figure out who that guy is, I would be thankful and put 582 00:28:54,740 --> 00:28:57,680 your name and credit on the next time that I run this presentation. 583 00:28:58,240 --> 00:28:59,140 Our time is up. 584 00:28:59,180 --> 00:29:01,440 If you have any other questions, feel free to catch me outside. 585 00:29:01,640 --> 00:29:02,220 Thank you so much.